Collecting log data from HAProxy

[gsmith]

@foss4ever

I’ve read about Sidecar and Filebeat but these approaches seem more complicated to me - and not native to Linux like rsyslog is…

I have said the same thing to my boss, I wanted to use something native with Linux and not a third party application. As we progress in log management I realized Rsyslog was unable to perform some request we need and if Rsyslog was able to do what we wanted it was a pain in the @$$ to configure.
I did find some documentation about audit logs with Rsyslog. Maybe something there might help.

Graylog support for auditd in syslogs

Hi All, Are there any resources to support auditd logging within graylog with Centos hosts to parse out the fields correctly. I have tried enabling auditd logging via syslog to a udp syslog input as shown below but the fields vary and are not parsed corecttly. [linux-audit] Would anothe roption be to use something like NXLog imfile module to read the file and then send it to a GELF input. Would this work as the json should contain the fields. Alternatively, would it be better to use a GROK…

https://docs.graylog.org/v1/docs/syslog

Sending data from Solaris using rsyslog

Hello, I want to send user audit data (logins, su and sudo usage) from our Solaris 11.4 systems to Graylog. So I installed and configured rsyslog 8.2002.0. This is working in that way, that all information is logged to log files as configured. But not all information written to logs is send to Graylog. For example there are a log of auth.info entires in /var/log/auth.log, but they are not send to Graylog. I get messages with authpriv.notice and kern.warnings. I read docs, tried a lot things y…

How to send Audit Logs to Remote Rsyslog Server in CentOS/RHEL 6,7 – The Geek...

Sorry I cant give you a direct answer maybe someone here has done this before.