skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-syslog-centralization-with-rsyslog

Generates TLS-encrypted rsyslog server and client configurations for centralized log collection.

954|172|Updated Mar 13, 2026
Search Tags:#security operations#TLS#syslog#log forwarding#rsyslog#log centralization#gnutls
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-syslog-centralization-with-rsyslog
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-syslog-centralization-with-rsyslog
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/security-operations/implementing-syslog-centralization-with-rsyslog
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-syslog-centralization-with-rsyslog

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jinja2, paramiko, and includes scripts (resource) components.

What problem does it solve?

Centralizing logs from many hosts over rsyslog is error-prone: UDP silently drops messages, TLS is often misconfigured into plaintext, and in-memory queues lose logs on restart. This Skill generates correct server and client rsyslog configurations with GnuTLS encryption, x509 certificate authentication, per-host log segregation, and disk-assisted queues.

Core Features & Use Cases

  • TLS Server Configuration: Generates an imtcp listener on port 6514 with GnuTLS stream drivers, x509/name authentication, and per-host log file templates.
  • Reliable Client Forwarding: Produces omfwd client configs with disk-assisted LinkedList queues, save-on-shutdown, and unlimited retry for high-availability delivery.
  • SSH Deployment & Validation: Deploys configurations to servers via paramiko and verifies end-to-end TLS log delivery.
  • Use Case: A security operations team needs to centralize logs from 50 Linux servers to meet NIST CSF monitoring requirements; the Skill generates compliant configs, deploys them, and confirms logs land in per-host directories.

Quick Start

Ask the agent to generate and deploy TLS-encrypted rsyslog server and client configurations for your log server and client IPs, then validate delivery with a test message.

Frequently Asked Questions about implementing-syslog-centralization-with-rsyslog

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure rsyslog for centralized logging with TLS?▼

Configure the server with imtcp loading the gtls stream driver on port 6514 and StreamDriverAuthMode x509/name, then configure clients with omfwd using protocol tcp, StreamDriver gtls, and a permittedPeer list. Generate certificates with OpenSSL before deploying.

How to make rsyslog forwarding reliable without losing messages?▼

Use TCP or TLS instead of UDP, and enable disk-assisted queues with queue.type LinkedList, a queue.filename, queue.saveonshutdown on, and action.resumeRetryCount -1. This spools messages to disk during outages and survives rsyslog restarts.

Why is my rsyslog TLS port 6514 sending plaintext?▼

imtcp or omfwd without StreamDriver gtls and StreamDriverMode 1 falls back to cleartext even on port 6514. Verify with openssl s_client -connect server:6514 returning a certificate and tcpdump showing ciphertext rather than readable log lines.

Does rsyslog x509 authentication accept any client certificate?▼

With StreamDriverAuthMode anon, any client certificate is accepted, which is insecure. Use x509/name with a permittedPeer list so only clients with known certificate common names can forward logs.

How do I verify rsyslog log delivery end to end?▼

Send a test message from the client with logger -n server -P 6514 -T, then confirm the line appears in the per-host file under /var/log/remote/<hostname>/. A reachable port alone does not prove logs are stored.

Related Skills

Explore More Software Engineering Skills→
ArianHobson333ArianHobson333
7

tls-certificate-analysis

Extracts TLS certificate metadata, issuer, SANs, and JARM fingerprints.

Community
Advanced
masermediagroup-stackmasermediagroup-stack
1

siem-logging

Configure centralized SIEM logging and detection-rule development across cloud and on-prem environments.

Community
Advanced
davepoondavepoon
3.4k

certificate-monitoring

Monitors SSL/TLS certificate expiration and issues Let's Encrypt certificates via TLS Radar MCP tools.

Community
Advanced
sudohakansudohakan

fluentbit-generator

Generate Fluent Bit configurations for Kubernetes log collection to Elasticsearch.

Community
Advanced