Configure rsyslog for Log Forwardng

[lsuperstarl]

Ok so, this might be a long one.

We have Trend Micro WFBSS that we recently enabled the API for log forwarding, downloaded the script and set it up “correctly” for log collection and storage.

This script is to collect logs from our subscription and save it to /var/log/trendmicro. Then in which case a Microsoft Sentinel Syslog collector retrieves it for analysis. Now, what I would guess is that Sentinel syslog data connector uses rsyslog in Red Hat (our central logging server) to retrieve those logs.

My question is, how would I configure /etc/rsyslog.conf in order to: retrieve trend micro logs from our subscription, save them in /var/log/trendmicro and then have rsyslog send it to Microsoft Sentinel?

[vitob]

I am not certain but I would think you could create a custom drop in config in the path of /etc/rsyslog.d/ so it is separate from the main config because if you set the target in there, it will forward all logs. So the drop in will only target trend micro logs with the rule defined

Log trend micro stuff

trend.* /var/log/trendmicro

And add
Target=" Microsoft Sentinel " Port=“XXX” Protocol=“tcp”) for forwarding

### sample forwarding rule

action(type=“omfwd”

An on-disk queue is created for this action. If the remote host is

down, messages are spooled to disk and sent when it is up again.

#queue.filename=“fwdRule1” # unique name prefix for spool files
#queue.maxdiskspace=“1g” # 1gb space limit (use as much as possible)
#queue.saveonshutdown=“on” # save messages to disk on shutdown
#queue.type=“LinkedList” # run asynchronously
#action.resumeRetryCount=“-1” # infinite retries if host is down

Remote Logging (we use TCP for reliable delivery)

remote_host is: name/ip, e.g. 192.168.0.1, port optional e.g. 10514

Target=“remote_host” Port=“XXX” Protocol=“tcp”)

[scheff1]

Welcome to Spiceworks and its community, a community of IT professionals for IT professionals with a focus on SME. And please don’t forget to read the recommendations of our field guides, especially those on getting started and on pos(t)ing good questions, including the helpful references found on the bottom of its web page.

@lsuperstarl

This script is to collect logs from our subscription and save it to /var/log/trendmicro. Then in which case a Microsoft Sentinel Syslog collector retrieves it for analysis. Now, what I would guess is that Sentinel syslog data connector uses rsyslog in Red Hat (our central logging server) to retrieve those logs.

Sorry, I didn’t get what is a service and what is implemented as appliance.

• Do you have one central logging server or several logging servers like Trend Micro WFBSS and Microsoft Sentinel Syslog Collector? (I thought Sentinel Syslog being a 3rd party product resp. service, not of Microsoft.)