Configuring Rsyslog

sudo apt-get update
sudo apt-get install ca-certificates -y
sudo apt-get install rsyslog-gnutls

sudo yum install ryslog-gnutls
sudo yum-get install ca-certificates -y

# Setup disk assisted queues
$WorkDirectory /var/spool/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1   # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g    # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on   # save messages to disk on shutdown
$ActionQueueType LinkedList    # run asynchronously
$ActionResumeRetryCount -1    # infinite retries if host is down
​
#RsyslogGnuTLS
$DefaultNetstreamDriverCAFile /etc/ssl/certs/ca-certificates.crt
​
template(name="json-template" type="list") {
      constant(value="{")
      constant(value="\"@timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"@version\":\"1")
      constant(value="\",\"message\":\"")     property(name="msg" format="json")
      constant(value="\",\"hostname\":\"")    property(name="hostname")
      constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")
      constant(value="\",\"pri\":\"")         property(name="pri-text")
      constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")
      constant(value="\",\"programname\":\"") property(name="programname")
      constant(value="\",\"procid\":\"")      property(name="procid")
      constant(value="\",\"fromhost-ip\":\"") property(name="fromhost-ip")
      constant(value="\",\"auth_token\":\"AUTH_TOKEN")
      constant(value="\",\"pack\":\"rsyslog")
      constant(value="\"}\n")
}
​
# Send messages to easySIEM over TCP using the template.
# ACTION BLOCK
action(type="omfwd" protocol="tcp" target="TARGET_URL" port="8888" 
       template="json-template" StreamDriver="gtls" 
       StreamDriverMode="1" StreamDriverAuthMode="x509/name"
       StreamDriverPermittedPeers="*.easysiem.com")

if ( $syslogfacility-text startswith "auth"  and
($programname == ["sshd","sudo","su","systemd-logind",
                  "groupdel","groupadd","usermod","useradd",
                  "userdel","groupmod","chage", "chfn"]) 
                  or $syslogtag startswith "suricata") 
then {
                  
action(type="omfwd" protocol="tcp" target="TARGET_URL" port="8888" 
template="json-template" StreamDriver="gtls" 
StreamDriverMode="1" StreamDriverAuthMode="x509/name"
StreamDriverPermittedPeers="*.eaysiem.com")             
​
stop                 
}