Configuring a remote syslog server for user audit logs

Use this procedure to configure the remote syslog service on a remote server after the Fabric Services System application has been installed.
  1. Update the sample-input.json file.
    In the rsyslog section, set the following parameters:
    • host: the IP address or FQDN of the remote syslog server
    • port: the port that the rsyslog utility uses for network connectivity
    • proto: the protocol used for syslog traffic, either TCP or UDP
      "fss": {
          ...
      },
      "rsyslog": {
          "host": "192.0.2.149",
          "port": 514,
          "proto": "udp"
      },
    
  2. Run the fss-fluent.sh script to update the system configuration.
    The fss-fluent.sh file is available in the /root/bin directory.
    [root@fss-deployer ~]# ./bin/fss-fluentbit.sh install updated-input-kvm-fss-deployer.json
    source /var/lib/fss/config/fssEnv.sh
    input_file: updated-input-kvm-fss-deployer.json
    fss-logs        default         1               2023-03-14 06:24:22.306303226 +0000 UTC deployed        fluent-bit-0.20.9               1.9.9
    fss-logs chart already installed, SKIP_K8S=false
    Do you want to restart fss-logs with new values : Are you sure [YyNn]? y
    rsyslog_host: 192.0.2.149
    rsyslog_port: 51400
    rsyslog_proto: udp
    Creating fss-logs-pvc
    persistentvolumeclaim/fss-logs-pvc unchanged
     
    Starting fss-logs
    helm upgrade -i fss-logs /var/lib/rancher/k3s/storage/pvc-repo/download/charts/fluent-bit-0.20.9.tgz -f /var/lib/fss/config/fluentbit-values.yaml
    Release "fss-logs" has been upgraded. Happy Helming!
    NAME: fss-logs
    LAST DEPLOYED: Tue Mar 14 06:35:51 2023
    NAMESPACE: default
    STATUS: deployed
    REVISION: 2
    NOTES:
    Get Fluent Bit build information by running these commands:
     
    export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=fluent-bit,app.kubernetes.io/instance=fss-logs" -o jsonpath="{.items[0].metadata.name}")
    kubectl --namespace default port-forward $POD_NAME 2020:2020
    curl http://127.0.0.1:2020
  3. Check the remote syslog server to ensure that logs are being forwarded.