Configuring a remote syslog server for user audit logs

Use this procedure to configure the remote syslog service on a remote server after the Fabric Services System application has been installed.
  1. Update the sample-input.json file.
    In the rsyslog section, set the following parameters:
    • host: the IP address or FQDN of the remote syslog server
    • port: the port that the rsyslog utility uses for network connectivity
    • proto: the protocol used for syslog traffic, either TCP or UDP
      "fss": {
      ...
  },
  "rsyslog": {
      "host": "192.0.2.149",
      "port": 514,
      "proto": "udp"
  },
  2. Run the fss-fluent.sh script to update the system configuration.
    The fss-fluent.sh file is available in the /root/bin directory.
    [root@fss-deployer ~]# ./bin/fss-fluentbit.sh install updated-input-kvm-fss-deployer.json
source /var/lib/fss/config/fssEnv.sh
input_file: updated-input-kvm-fss-deployer.json
fss-logs        default         1               2023-03-14 06:24:22.306303226 +0000 UTC deployed        fluent-bit-0.20.9               1.9.9
fss-logs chart already installed, SKIP_K8S=false
Do you want to restart fss-logs with new values : Are you sure [YyNn]? y
rsyslog_host: 192.0.2.149
rsyslog_port: 51400
rsyslog_proto: udp
Creating fss-logs-pvc
persistentvolumeclaim/fss-logs-pvc unchanged
 
Starting fss-logs
helm upgrade -i fss-logs /var/lib/rancher/k3s/storage/pvc-repo/download/charts/fluent-bit-0.20.9.tgz -f /var/lib/fss/config/fluentbit-values.yaml
Release "fss-logs" has been upgraded. Happy Helming!
NAME: fss-logs
LAST DEPLOYED: Tue Mar 14 06:35:51 2023
NAMESPACE: default
STATUS: deployed
REVISION: 2
NOTES:
Get Fluent Bit build information by running these commands:
 
export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=fluent-bit,app.kubernetes.io/instance=fss-logs" -o jsonpath="{.items[0].metadata.name}")
kubectl --namespace default port-forward $POD_NAME 2020:2020
curl http://127.0.0.1:2020
  3. Check the remote syslog server to ensure that logs are being forwarded.