It reads and automatically parses the Linux audit logs. You can override the file name using the filename() parameter and the prefix for the created name-value pairs using the prefix() parameter. Any additional parameters are passed to the file source.
NOTE: Most recent Linux distributions enable Security-Enhanced Linux (SELinux) or AppArmor as a security measure. If enabled, these technologies might disable access to the Linux Audit log file by default. Consult their manuals to enable Linux Audit log access for syslog-ng OSE.
Declaration:
linux-audit(options);
Example: Using the linux-audit() driver
source s_auditd {
linux-audit(
prefix("test.")
hook-commands(
startup("auditctl -w /etc/ -p wa")
shutdown("auditctl -W /etc/ -p wa")
)
);
};
The file() driver has the following options:
filename()
Description: The log file of linux-audit. The syslog-ng OSE application reads the Linux audit logs from this file.
prefix()
| Synopsis: |
prefix() |
| Default: |
.auditd. |
Description: Insert a prefix before the name part of the parsed name-value pairs to help further processing. For example:
-
To insert the my-parsed-data. prefix, use the prefix(my-parsed-data.) option.
-
To refer to a particular data that has a prefix, use the prefix in the name of the macro, for example, ${my-parsed-data.name}.
-
If you forward the parsed messages using the IETF-syslog protocol, you can insert all the parsed data into the SDATA part of the message using the prefix(.SDATA.my-parsed-data.) option.
Names starting with a dot (for example, .example) are reserved for use by syslog-ng OSE. Note that if you use an empty prefix (prefix("")) or one starting with a dot, syslog-ng OSE might replace the original value of an existing macro (note that only soft macros can be overwritten, see Hard versus soft macros for details). To avoid such problems, use a prefix when naming the parsed values, for example, prefix(my-parsed-data.)
From syslog-ng OSE version 3.35, you can use the mqtt() source to fetch messages from MQTT brokers.
The mqtt() source builds on the MQTT protocol, and uses its client and broker entities.
NOTE: The rest of this chapter and its sections build on your familiarity with the MQTT protocol, the concept of client and broker entities, and how these entities function within an MQTT system.
Declaration:
source s_mqtt{
mqtt(
address("tcp://<hostname>:<port-number>")
topic("<topic-name>")
);
};
Example: Using the mqtt() source in your configuration
The following example illustrates an mqtt() source configured to fetch messages from the MQTT broker running on localhost:4444 using the test/test topic, and send them to the localhost:4445 address.
@version: 3.35
@include "scl.conf"
source s_mqtt {
mqtt(
address("tcp://localhost:4444")
topic("test/test")
);
};
destination d_network {
network(
"localhost"
port(4445)
);
};
log {
source(s_mqtt);
destination(d_network);;
};
Using the current implementation of the mqtt() destination has the following prerequisites:
