Ubuntu é 24.04
Estou tentando configurar o rsyslog para receber syslogs criptografados.
Eu fiz o
apt install rsyslog-gnutls
Mas olhando em /usr/lib/x86_64-linux-gnu/rsyslog/ não vejo o arquivo gtls.so
Eu vejo o lmnsd_gtls.so, mas não o gtls.so
Então, quando tento iniciar o rsyslogd, ele mostra:
Feb 06 11:29:45 syslog-proxy rsyslogd[22861]: could not load module 'gtls', errors: trying to load module /usr/lib/x86_64-linux-gnu/rsyslog/gtls.so: /usr/lib/x86_64-linux-gnu/rsyslog/gtls.so: cannot open shared object file: No such file>
Ele também reclama:
error during parsing file /etc/rsyslog.conf, on or before line 16: parameter 'StreamDriverAuthMode' not known
error during parsing file /etc/rsyslog.conf, on or before line 16: parameter 'StreamDriverMode' not known
error during parsing file /etc/rsyslog.conf, on or before line 16: parameter 'StreamDriver' not known
O rsyslog.conf:
# Set up encryption with certificates
$DefaultNetstreamDriver gtls
$DefaultNetstreamDriverCAFile /etc/rsyslog/certs/rsyslog.crt
$DefaultNetstreamDriverCertFile /etc/rsyslog/certs/rsyslog.crt
$DefaultNetstreamDriverKeyFile /etc/rsyslog/certs/rsyslog.key
#### MODULES ####
module(load="imuxsock") # provides support for local system logging
module(load="imtcp")
module(load="gtls") # For TLS encryption
# Enable TCP on port 514 (unencrypted) and a different port for encrypted logging (e.g., 6514)
input(type="imtcp" port="514")
input(type="imtcp" port="6514" StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="anon")
# provides kernel logging support and enable non-kernel klog messages
#module(load="imklog" permitnonkernelfacility="on")
###########################
#### GLOBAL DIRECTIVES ####
###########################
# Filter duplicated messages
$RepeatedMsgReduction on
#
# Set the default permissions for all log files.
#
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
# Drop privileges to syslog after starting
$PrivDropToUser syslog
$PrivDropToGroup syslog
#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog
#
# Include all config files in /etc/rsyslog.d/
####################################
# Remote log handling #
####################################
$template remote-incoming-logs, "/var/log/remotehosts/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?remote-incoming-logs
&~
