mrcharles
64198418ee
Split per O&M lane work order. Full history: KNEL/PFVCluster. https://projects.knownelement.com/issues/769#note-4152
31 lines
975 B
Bash
31 lines
975 B
Bash
#!/bin/bash
|
|
#
|
|
# deploy-rsyslog.sh — rsyslog forwarding to Wazuh for PVE hosts [#335]
|
|
# Run as root on the target host. Idempotent; safe to re-run.
|
|
# Forwards everything via TCP/514 to tsys-wazuh.knel.net (Tailscale
|
|
# overlay; manager allowlist = 100.64.0.0/10). journald stays the local SoR.
|
|
#
|
|
set -euo pipefail
|
|
|
|
MGR="tsys-wazuh.knel.net"
|
|
|
|
if ! dpkg -s rsyslog >/dev/null 2>&1; then
|
|
echo "installing rsyslog"
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y rsyslog
|
|
fi
|
|
|
|
F=/etc/rsyslog.d/90-forward-wazuh.conf
|
|
if [ ! -f "$F" ]; then
|
|
printf '# Wazuh syslog forwarding (Tailscale overlay) [#335]\n*.* @@%s:514\n' "$MGR" > "$F"
|
|
echo "forward rule installed"
|
|
else
|
|
echo "forward rule already present"
|
|
fi
|
|
|
|
systemctl enable --now rsyslog >/dev/null 2>&1 || true
|
|
systemctl restart rsyslog
|
|
sleep 2
|
|
systemctl -q is-active rsyslog && echo "rsyslog ACTIVE"
|
|
logger -p auth.warning "wazuh-trail-test host=$(hostname) stamp=$(date +%s)"
|
|
echo "trail event sent from $(hostname)"
|