Log Forwarding (SIEM)¶
Ship the security-relevant logs of every server to a central collector (a SIEM or log server) over TLS. Off-host logging is a compliance cornerstone: a host that is compromised later can no longer erase the evidence it already shipped.
Find it under System → Log Forwarding (admin only). The configuration is fleet-wide — it is pushed to every active server and re-applied automatically at controller start, so it survives reboots and reaches servers that were briefly unreachable.
TLS is mandatory¶
There is no plaintext option. When you enable forwarding you must provide:
- a collector host and port (default
6514, syslog-over-TLS / RFC 5425), and - the CA certificate (PEM) that signs the collector's certificate.
The agent configures rsyslog with the GnuTLS network driver and verifies the
collector's certificate against your CA (x509/certvalid). If you also set a
Permitted peer, the collector's certificate name (CN/SAN) must match it
exactly (x509/name, name pinning).
The forwarding action uses an on-disk spool (queue.saveonshutdown,
maxdiskspace=256m, infinite resume-retry), so a brief collector outage or a
burst never drops messages.
Sources¶
All security-relevant sources are on by default. You can narrow the set:
| Source | What it forwards |
|---|---|
| Auth / SSH | auth, authpriv — sshd, sudo, PAM (logins, privilege use) |
| Nginx | /var/log/nginx/access.log + error.log (via imfile) |
Postfix + Dovecot (mail facility) |
|
| fail2ban | Ban/unban events |
| Panel audit | The enconf-* services' journal (API + agent) |
| Journal | Everything else the journal carries (daemon, cron, kernel) |
When Journal is on, everything is forwarded in one action (auth, mail, fail2ban-via-journal and the panel services are already included), and the per-facility filters are omitted to avoid shipping a message twice. Turn Journal off to forward only the individually selected facilities.
Applying & status¶
Saving validates the whole rsyslog configuration (rsyslogd -N1) on each server
before restarting rsyslog and rolls back the drop-in if validation fails —
so a bad value can never leave rsyslog unable to start. The per-server
distribution panel shows, for each active server, whether the config was
applied or why it failed (e.g. an unreachable agent).
The agent installs rsyslog + rsyslog-gnutls on demand (Debian 13 ships
journald-only by default).
Files written on the server¶
| Path | Contents |
|---|---|
/etc/rsyslog.d/00-enconf-forward.conf |
The forwarding ruleset + source routing |
/etc/rsyslog.d/enconf-forward-ca.pem |
Your collector CA bundle (root-only) |
Disabling forwarding removes both files and restarts rsyslog.