https://github.com/osquery/osquery logo
s

slevchenko

02/07/2023, 1:14 PM
@seph Hi, do you know if there any example configurations for remote syslog ? I mean forwarding results to
<ip>:<port>
syslog server, or posix domain, whatever works
s

seph

02/07/2023, 2:25 PM
I’m not sure osquery support forwarding to a remote syslog. I don’t see mention of it in the docs.
s

slevchenko

02/07/2023, 2:27 PM
Syslog clients usually support writing into POSIX socket. Is it possible configure osquery to write into a socket?
s

seph

02/07/2023, 2:32 PM
I’m not sure how it’s implemented. You’d need to check the source.
s

slevchenko

02/07/2023, 2:33 PM
Ok maybe you know if it's possible to configure https log sender using self-signed certs ?
s

seph

02/07/2023, 2:37 PM
Depends a bit on what you mean… I think the normal loggers osquery ships are local syslog, files, and kafka. Then there’s the remote TLS server. TLS logging is part of that, it might work without the rest of the tls stuff, I have no idea. You’d have to test it, or try to read the code. There is an option for client certs.
s

slevchenko

02/07/2023, 2:38 PM
thanks alot
z

zwass

02/07/2023, 4:49 PM
HTTPS definitely supports self-signed certs. You need to configure
--tls_server_certs
s

slevchenko

02/07/2023, 5:05 PM
As I understood server must support authentication mechanism, so I'll either will need server which supports this kind of negotiation
z

zwass

02/07/2023, 5:22 PM
Yes, that is true.
I think the
syslog
plugin does what you want though. I haven't used it for a long time so I don't remember exactly. But it's worth a try.
s

slevchenko

02/07/2023, 5:24 PM
For that to work I need to set a socket path or an address:port pair, and I can't find proper settings
That's why I'm asking - I just don't know if such settings even exist
z

zwass

02/07/2023, 5:26 PM
I think osquery logs to your local syslog and then you set up forwarding within syslog?
s

slevchenko

02/07/2023, 5:27 PM
in such case how that'll work if I have two logging plugins set ? like "filesystem,syslog"
becuase for filsystem I have to set a filepath, and for syslog a POSIX socket
z

zwass

02/07/2023, 5:31 PM
I believe you can use
logger_path
to set the
filesystem
logging path and then
syslog
will log to the local syslog.
s

slevchenko

02/07/2023, 5:32 PM
Thanks, I will try that
z

zwass

02/07/2023, 5:33 PM
Good luck! Let us know if it works 🙂
s

slevchenko

02/07/2023, 5:33 PM
Ok thanks again.
3 Views