RSyslog Secure Configuration: Advanced Enterprise Guide#

1
#!/bin/bash
2
# setup-rsyslog-tls.sh - Configure TLS certificates for RSyslog
3

4
set -euo pipefail
5

6
# Configuration variables
7
CERT_DIR="/etc/ssl/rsyslog"
8
CA_DIR="/etc/ssl/rsyslog/ca"
9
SERVER_NAME="logserver.example.com"
10
CLIENT_NAME="logclient.example.com"
11
ORGANIZATION="Example Organization"
12
COUNTRY="US"
13
STATE="California"
14
CITY="San Francisco"
15

16
# Create certificate directory structure
17
setup_cert_directories() {
18
    echo "Setting up certificate directories..."
19

20
    mkdir -p "$CERT_DIR"
21
    mkdir -p "$CA_DIR"
22
    chmod 700 "$CERT_DIR"
23
    chmod 700 "$CA_DIR"
24

25
    echo "Certificate directories created"
26
}
27

28
# Generate Certificate Authority
29
generate_ca() {
30
    echo "Generating Certificate Authority..."
31

32
    # Generate CA private key
33
    openssl genrsa -out "$CA_DIR/ca-key.pem" 4096
34

35
    # Generate CA certificate
36
    openssl req -new -x509 -days 3650 -key "$CA_DIR/ca-key.pem" \
37
        -out "$CERT_DIR/ca.pem" \
38
        -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/CN=RSyslog-CA"
39

40
    chmod 400 "$CA_DIR/ca-key.pem"
41
    chmod 444 "$CERT_DIR/ca.pem"
42

43
    echo "Certificate Authority generated"
44
}
45

46
# Generate server certificate
47
generate_server_cert() {
48
    echo "Generating server certificate..."
49

50
    # Generate server private key
51
    openssl genrsa -out "$CERT_DIR/server-key.pem" 2048
52

53
    # Generate certificate signing request
54
    openssl req -new -key "$CERT_DIR/server-key.pem" \
55
        -out "$CERT_DIR/server.csr" \
56
        -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/CN=$SERVER_NAME"
57

58
    # Create extensions file for server certificate
59
    cat > "$CERT_DIR/server-ext.conf" << EOF
60
basicConstraints = CA:FALSE
61
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
62
subjectAltName = @alt_names
63

64
[alt_names]
65
DNS.1 = $SERVER_NAME
66
DNS.2 = localhost
67
IP.1 = 127.0.0.1
68
EOF
69

70
    # Generate server certificate
71
    openssl x509 -req -in "$CERT_DIR/server.csr" \
72
        -CA "$CERT_DIR/ca.pem" \
73
        -CAkey "$CA_DIR/ca-key.pem" \
74
        -CAcreateserial \
75
        -out "$CERT_DIR/server-cert.pem" \
76
        -days 365 \
77
        -extensions v3_req \
78
        -extfile "$CERT_DIR/server-ext.conf"
79

80
    # Set permissions
81
    chmod 400 "$CERT_DIR/server-key.pem"
82
    chmod 444 "$CERT_DIR/server-cert.pem"
83

84
    # Cleanup
85
    rm "$CERT_DIR/server.csr" "$CERT_DIR/server-ext.conf"
86

87
    echo "Server certificate generated"
88
}
89

90
# Generate client certificate
91
generate_client_cert() {
92
    echo "Generating client certificate..."
93

94
    # Generate client private key
95
    openssl genrsa -out "$CERT_DIR/client-key.pem" 2048
96

97
    # Generate certificate signing request
98
    openssl req -new -key "$CERT_DIR/client-key.pem" \
99
        -out "$CERT_DIR/client.csr" \
100
        -subj "/C=$COUNTRY/ST=$STATE/L=$CITY/O=$ORGANIZATION/CN=$CLIENT_NAME"
101

102
    # Generate client certificate
103
    openssl x509 -req -in "$CERT_DIR/client.csr" \
104
        -CA "$CERT_DIR/ca.pem" \
105
        -CAkey "$CA_DIR/ca-key.pem" \
106
        -CAcreateserial \
107
        -out "$CERT_DIR/client-cert.pem" \
108
        -days 365
109

110
    # Set permissions
111
    chmod 400 "$CERT_DIR/client-key.pem"
112
    chmod 444 "$CERT_DIR/client-cert.pem"
113

114
    # Cleanup
115
    rm "$CERT_DIR/client.csr"
116

117
    echo "Client certificate generated"
118
}
119

120
# Verify certificates
121
verify_certificates() {
122
    echo "Verifying certificates..."
123

124
    # Verify server certificate
125
    if openssl verify -CAfile "$CERT_DIR/ca.pem" "$CERT_DIR/server-cert.pem"; then
126
        echo "Server certificate verification: PASSED"
127
    else
128
        echo "Server certificate verification: FAILED" >&2
129
        exit 1
130
    fi
131

132
    # Verify client certificate
133
    if openssl verify -CAfile "$CERT_DIR/ca.pem" "$CERT_DIR/client-cert.pem"; then
134
        echo "Client certificate verification: PASSED"
135
    else
136
        echo "Client certificate verification: FAILED" >&2
137
        exit 1
138
    fi
139

140
    echo "Certificate verification completed"
141
}
142

143
# Set proper ownership
144
set_ownership() {
145
    echo "Setting certificate ownership..."
146

147
    chown -R root:root "$CERT_DIR"
148
    chown -R root:root "$CA_DIR"
149

150
    echo "Certificate ownership configured"
151
}
152

153
# Main execution
154
echo "=== RSyslog TLS Certificate Setup ==="
155
setup_cert_directories
156
generate_ca
157
generate_server_cert
158
generate_client_cert
159
verify_certificates
160
set_ownership
161

162
echo "TLS certificate setup completed successfully!"
163
echo "CA Certificate: $CERT_DIR/ca.pem"
164
echo "Server Certificate: $CERT_DIR/server-cert.pem"
165
echo "Server Key: $CERT_DIR/server-key.pem"
166
echo "Client Certificate: $CERT_DIR/client-cert.pem"
167
echo "Client Key: $CERT_DIR/client-key.pem"

1
#!/bin/bash
2
# rsyslog-signing-setup.sh - Configure log signing for integrity
3

4
# Install signing module dependencies
5
install_signing_dependencies() {
6
    echo "Installing log signing dependencies..."
7

8
    # For Debian/Ubuntu
9
    if command -v apt-get >/dev/null 2>&1; then
10
        apt-get update
11
        apt-get install -y rsyslog-gnutls libgt-dev libgnutls28-dev
12
    fi
13

14
    # For RHEL/CentOS
15
    if command -v yum >/dev/null 2>&1; then
16
        yum install -y rsyslog-gnutls guardtime-devel gnutls-devel
17
    fi
18

19
    echo "Dependencies installed"
20
}
21

22
# Configure log signing
23
configure_log_signing() {
24
    echo "Configuring log signing..."
25

26
    # Create signing configuration
27
    cat > /etc/rsyslog.d/10-signing.conf << 'EOF'
28
# Log signature configuration
29

30
# Load signature provider module
31
$ModLoad lmsig_gt
32

33
# Configure signature provider
34
$ActionLmSigGTSignatureProvider gt://guard.com
35

36
# File signature settings
37
$LmSigGTSigner "rsyslog-signer"
38
$LmSigGTHashChainMaxLength 1000
39
$LmSigGTTimestampTimeout 10
40

41
# Template for signed logs
42
$template SignedLogFormat,"%timegenerated:::date-rfc3339% %HOSTNAME% %syslogtag%%msg%\n"
43

44
# Sign critical security logs
45
auth.*                          /var/log/auth-signed.log;SignedLogFormat;LmSigGT
46
authpriv.*                      /var/log/authpriv-signed.log;SignedLogFormat;LmSigGT
47
security.*                      /var/log/security-signed.log;SignedLogFormat;LmSigGT
48

49
# Configure signature files
50
$LmSigGTSigFile /var/log/auth-signed.log.gtsig
51
$LmSigGTStateFile /var/log/auth-signed.log.gtstate
52
EOF
53

54
    echo "Log signing configured"
55
}
56

57
# Create signature verification script
58
create_verification_script() {
59
    cat > /usr/local/bin/verify-log-signatures.sh << 'EOF'
60
#!/bin/bash
61
# Log signature verification script
62

63
LOG_DIR="/var/log"
64
VERIFICATION_LOG="/var/log/signature-verification.log"
65

66
verify_signatures() {
67
    local log_file=$1
68
    local sig_file="${log_file}.gtsig"
69
    local state_file="${log_file}.gtstate"
70

71
    if [[ -f "$sig_file" && -f "$state_file" ]]; then
72
        echo "Verifying signatures for: $log_file" | tee -a "$VERIFICATION_LOG"
73

74
        if gtsig verify --sig-file "$sig_file" --log-file "$log_file"; then
75
            echo "  VERIFICATION PASSED: $log_file" | tee -a "$VERIFICATION_LOG"
76
            return 0
77
        else
78
            echo "  VERIFICATION FAILED: $log_file" | tee -a "$VERIFICATION_LOG"
79
            logger -p auth.alert "Log signature verification failed for $log_file"
80
            return 1
81
        fi
82
    else
83
        echo "  SIGNATURE FILES MISSING: $log_file" | tee -a "$VERIFICATION_LOG"
84
        return 1
85
    fi
86
}
87

88
# Main verification loop
89
echo "Starting log signature verification: $(date)" | tee -a "$VERIFICATION_LOG"
90

91
verification_failed=0
92

93
for log_file in "$LOG_DIR"/auth-signed.log "$LOG_DIR"/authpriv-signed.log "$LOG_DIR"/security-signed.log; do
94
    if [[ -f "$log_file" ]]; then
95
        if ! verify_signatures "$log_file"; then
96
            verification_failed=1
97
        fi
98
    fi
99
done
100

101
if [[ $verification_failed -eq 1 ]]; then
102
    echo "One or more signature verifications failed!" | tee -a "$VERIFICATION_LOG"
103
    exit 1
104
else
105
    echo "All signature verifications passed" | tee -a "$VERIFICATION_LOG"
106
    exit 0
107
fi
108
EOF
109

110
    chmod +x /usr/local/bin/verify-log-signatures.sh
111

112
    # Create systemd timer for regular verification
113
    cat > /etc/systemd/system/log-signature-verification.service << EOF
114
[Unit]
115
Description=Log Signature Verification
116
After=rsyslog.service
117

118
[Service]
119
Type=oneshot
120
ExecStart=/usr/local/bin/verify-log-signatures.sh
121
User=root
122
StandardOutput=journal
123
StandardError=journal
124
EOF
125

126
    cat > /etc/systemd/system/log-signature-verification.timer << EOF
127
[Unit]
128
Description=Run log signature verification hourly
129
Requires=log-signature-verification.service
130

131
[Timer]
132
OnCalendar=hourly
133
Persistent=true
134

135
[Install]
136
WantedBy=timers.target
137
EOF
138

139
    systemctl enable log-signature-verification.timer
140
    systemctl start log-signature-verification.timer
141

142
    echo "Signature verification scheduled"
143
}
144

145
# Run setup
146
install_signing_dependencies
147
configure_log_signing
148
create_verification_script
149

150
echo "Log signing setup completed!"

1
#!/bin/bash
2
# ha-rsyslog-setup.sh - High-availability RSyslog configuration
3

4
# Configuration variables
5
PRIMARY_SERVER="log1.example.com"
6
SECONDARY_SERVER="log2.example.com"
7
VIP="192.168.1.200"
8
KEEPALIVED_PASSWORD="SecurePassword123!"
9

10
# Setup load balancer configuration
11
setup_load_balancer() {
12
    echo "Configuring HAProxy for log load balancing..."
13

14
    # Install HAProxy
15
    if command -v apt-get >/dev/null 2>&1; then
16
        apt-get update && apt-get install -y haproxy keepalived
17
    elif command -v yum >/dev/null 2>&1; then
18
        yum install -y haproxy keepalived
19
    fi
20

21
    # Configure HAProxy for RSyslog
22
    cat > /etc/haproxy/haproxy.cfg << EOF
23
global
24
    daemon
25
    user haproxy
26
    group haproxy
27
    log 127.0.0.1:514 local0
28
    chroot /var/lib/haproxy
29
    stats socket /var/lib/haproxy/stats
30
    tune.ssl.default-dh-param 2048
31

32
defaults
33
    mode tcp
34
    log global
35
    option tcplog
36
    option dontlognull
37
    retries 3
38
    timeout connect 5000ms
39
    timeout client 50000ms
40
    timeout server 50000ms
41

42
# RSyslog load balancing
43
frontend rsyslog_frontend
44
    bind *:514
45
    bind *:6514 ssl crt /etc/ssl/rsyslog/server-combined.pem ca-file /etc/ssl/rsyslog/ca.pem verify required
46
    default_backend rsyslog_servers
47

48
backend rsyslog_servers
49
    balance roundrobin
50
    option tcp-check
51
    tcp-check connect port 514
52
    server log1 $PRIMARY_SERVER:514 check
53
    server log2 $SECONDARY_SERVER:514 check backup
54

55
# Statistics interface
56
frontend stats
57
    bind *:8404
58
    stats enable
59
    stats uri /stats
60
    stats refresh 30s
61
    stats admin if TRUE
62
EOF
63

64
    # Configure Keepalived for VIP management
65
    cat > /etc/keepalived/keepalived.conf << EOF
66
vrrp_script chk_haproxy {
67
    script "/bin/kill -0 \`cat /var/run/haproxy.pid\`"
68
    interval 2
69
    weight 2
70
    fall 3
71
    rise 2
72
}
73

74
vrrp_instance VI_1 {
75
    state MASTER
76
    interface eth0
77
    virtual_router_id 51
78
    priority 110
79
    advert_int 1
80
    authentication {
81
        auth_type PASS
82
        auth_pass $KEEPALIVED_PASSWORD
83
    }
84
    virtual_ipaddress {
85
        $VIP
86
    }
87
    track_script {
88
        chk_haproxy
89
    }
90
}
91
EOF
92

93
    systemctl enable haproxy keepalived
94
    systemctl start haproxy keepalived
95

96
    echo "Load balancer configured"
97
}
98

99
# Configure primary log server
100
configure_primary_server() {
101
    echo "Configuring primary log server..."
102

103
    cat > /etc/rsyslog.d/10-ha-primary.conf << 'EOF'
104
# Primary server configuration with replication
105

106
# Load database module for log storage
107
$ModLoad ommysql
108

109
# Database connection for log storage
110
$template MySQLInsertTemplate,"INSERT INTO rsyslog (datetime, hostname, facility, priority, tag, message) VALUES ('%timegenerated:::date-mysql%', '%hostname%', '%syslogfacility%', '%syslogpriority%', '%syslogtag%', '%msg%')"
111

112
# Store all logs in MySQL database
113
*.*     :ommysql:localhost,rsyslog_db,rsyslog_user,rsyslog_password;MySQLInsertTemplate
114

115
# Replicate to secondary server
116
$ModLoad omfwd
117
*.*     @@log2.example.com:6514
118

119
# Local file backup
120
*.*     /var/log/primary-backup.log;SecureLogFormat
121

122
# Health check endpoint
123
$ModLoad imhttp
124
$HTTPServerDocumentRoot /var/www/rsyslog-health
125
$HTTPServerPort 8080
126

127
# Create health check document
128
$template HealthCheckTemplate,"/var/www/rsyslog-health/health.json"
129
$template HealthCheckContent,'{"status":"healthy","timestamp":"%timegenerated:::date-rfc3339%","server":"primary"}'
130

131
local0.info     ?HealthCheckTemplate;HealthCheckContent
132
EOF
133

134
    echo "Primary server configured"
135
}
136

137
# Configure secondary log server
138
configure_secondary_server() {
139
    echo "Configuring secondary log server..."
140

141
    cat > /etc/rsyslog.d/10-ha-secondary.conf << 'EOF'
142
# Secondary server configuration (backup)
143

144
# Database replication for secondary server
145
$ModLoad ommysql
146
$template MySQLInsertTemplate,"INSERT INTO rsyslog (datetime, hostname, facility, priority, tag, message) VALUES ('%timegenerated:::date-mysql%', '%hostname%', '%syslogfacility%', '%syslogpriority%', '%syslogtag%', '%msg%')"
147

148
# Store all logs in MySQL database (replica)
149
*.*     :ommysql:localhost,rsyslog_db,rsyslog_user,rsyslog_password;MySQLInsertTemplate
150

151
# Local file backup
152
*.*     /var/log/secondary-backup.log;SecureLogFormat
153

154
# Health check endpoint
155
$ModLoad imhttp
156
$HTTPServerDocumentRoot /var/www/rsyslog-health
157
$HTTPServerPort 8080
158

159
$template HealthCheckTemplate,"/var/www/rsyslog-health/health.json"
160
$template HealthCheckContent,'{"status":"healthy","timestamp":"%timegenerated:::date-rfc3339%","server":"secondary"}'
161

162
local0.info     ?HealthCheckTemplate;HealthCheckContent
163
EOF
164

165
    echo "Secondary server configured"
166
}
167

168
# Setup database replication
169
setup_database_replication() {
170
    echo "Setting up MySQL database replication..."
171

172
    # Create database schema
173
    mysql -u root -p << 'EOF'
174
CREATE DATABASE IF NOT EXISTS rsyslog_db;
175
USE rsyslog_db;
176

177
CREATE TABLE IF NOT EXISTS rsyslog (
178
    id INT AUTO_INCREMENT PRIMARY KEY,
179
    datetime DATETIME,
180
    hostname VARCHAR(255),
181
    facility INT,
182
    priority INT,
183
    tag VARCHAR(255),
184
    message TEXT,
185
    INDEX idx_datetime (datetime),
186
    INDEX idx_hostname (hostname),
187
    INDEX idx_facility (facility),
188
    INDEX idx_priority (priority)
189
);
190

191
CREATE USER IF NOT EXISTS 'rsyslog_user'@'localhost' IDENTIFIED BY 'rsyslog_password';
192
GRANT INSERT, SELECT ON rsyslog_db.* TO 'rsyslog_user'@'localhost';
193
FLUSH PRIVILEGES;
194
EOF
195

196
    echo "Database setup completed"
197
}
198

199
# Create monitoring script
200
create_monitoring_script() {
201
    cat > /usr/local/bin/rsyslog-ha-monitor.sh << 'EOF'
202
#!/bin/bash
203
# RSyslog HA monitoring script
204

205
LOGFILE="/var/log/rsyslog-ha-monitor.log"
206
PRIMARY_SERVER="log1.example.com"
207
SECONDARY_SERVER="log2.example.com"
208
VIP="192.168.1.200"
209

210
check_server_health() {
211
    local server=$1
212
    local port=$2
213

214
    if timeout 5 bash -c "</dev/tcp/$server/$port"; then
215
        return 0
216
    else
217
        return 1
218
    fi
219
}
220

221
check_database_health() {
222
    local server=$1
223

224
    if mysql -h "$server" -u rsyslog_user -prsyslog_password -e "SELECT 1;" >/dev/null 2>&1; then
225
        return 0
226
    else
227
        return 1
228
    fi
229
}
230

231
monitor_ha_status() {
232
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
233

234
    # Check primary server
235
    if check_server_health "$PRIMARY_SERVER" 514; then
236
        primary_status="UP"
237
    else
238
        primary_status="DOWN"
239
        echo "[$timestamp] ALERT: Primary server $PRIMARY_SERVER is DOWN" | tee -a "$LOGFILE"
240
        logger -p local0.alert "RSyslog HA: Primary server $PRIMARY_SERVER is DOWN"
241
    fi
242

243
    # Check secondary server
244
    if check_server_health "$SECONDARY_SERVER" 514; then
245
        secondary_status="UP"
246
    else
247
        secondary_status="DOWN"
248
        echo "[$timestamp] ALERT: Secondary server $SECONDARY_SERVER is DOWN" | tee -a "$LOGFILE"
249
        logger -p local0.alert "RSyslog HA: Secondary server $SECONDARY_SERVER is DOWN"
250
    fi
251

252
    # Check VIP status
253
    if check_server_health "$VIP" 514; then
254
        vip_status="UP"
255
    else
256
        vip_status="DOWN"
257
        echo "[$timestamp] ALERT: VIP $VIP is DOWN" | tee -a "$LOGFILE"
258
        logger -p local0.alert "RSyslog HA: VIP $VIP is DOWN"
259
    fi
260

261
    echo "[$timestamp] Status - Primary: $primary_status, Secondary: $secondary_status, VIP: $vip_status" | tee -a "$LOGFILE"
262
}
263

264
# Main monitoring loop
265
while true; do
266
    monitor_ha_status
267
    sleep 60
268
done
269
EOF
270

271
    chmod +x /usr/local/bin/rsyslog-ha-monitor.sh
272

273
    # Create systemd service for monitoring
274
    cat > /etc/systemd/system/rsyslog-ha-monitor.service << EOF
275
[Unit]
276
Description=RSyslog HA Monitor
277
After=network.target
278

279
[Service]
280
Type=simple
281
ExecStart=/usr/local/bin/rsyslog-ha-monitor.sh
282
Restart=always
283
RestartSec=10
284
User=root
285

286
[Install]
287
WantedBy=multi-user.target
288
EOF
289

290
    systemctl enable rsyslog-ha-monitor.service
291
    systemctl start rsyslog-ha-monitor.service
292

293
    echo "HA monitoring configured"
294
}
295

296
# Main execution
297
echo "=== RSyslog High-Availability Setup ==="
298

299
read -p "Configure this server as [primary/secondary/loadbalancer]: " server_role
300

301
case $server_role in
302
    "primary")
303
        configure_primary_server
304
        setup_database_replication
305
        ;;
306
    "secondary")
307
        configure_secondary_server
308
        ;;
309
    "loadbalancer")
310
        setup_load_balancer
311
        ;;
312
    *)
313
        echo "Invalid role. Choose primary, secondary, or loadbalancer"
314
        exit 1
315
        ;;
316
esac
317

318
create_monitoring_script
319

320
echo "RSyslog HA setup completed for role: $server_role"

1
#!/usr/bin/env python3
2
# rsyslog-dashboard.py - Real-time RSyslog monitoring dashboard
3

4
import json
5
import time
6
import subprocess
7
import sqlite3
8
import os
9
from datetime import datetime, timedelta
10
from collections import defaultdict
11
import argparse
12

13
class RSyslogMonitor:
14
    def __init__(self, db_path="/var/log/rsyslog-monitor.db"):
15
        self.db_path = db_path
16
        self.init_database()
17

18
    def init_database(self):
19
        """Initialize SQLite database for monitoring data"""
20
        conn = sqlite3.connect(self.db_path)
21
        cursor = conn.cursor()
22

23
        cursor.execute('''
24
            CREATE TABLE IF NOT EXISTS metrics (
25
                id INTEGER PRIMARY KEY AUTOINCREMENT,
26
                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
27
                metric_name TEXT,
28
                metric_value REAL,
29
                hostname TEXT
30
            )
31
        ''')
32

33
        cursor.execute('''
34
            CREATE TABLE IF NOT EXISTS alerts (
35
                id INTEGER PRIMARY KEY AUTOINCREMENT,
36
                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
37
                alert_type TEXT,
38
                message TEXT,
39
                severity TEXT,
40
                acknowledged BOOLEAN DEFAULT FALSE
41
            )
42
        ''')
43

44
        conn.commit()
45
        conn.close()
46

47
    def collect_rsyslog_stats(self):
48
        """Collect RSyslog statistics"""
49
        stats = {}
50

51
        try:
52
            # Get rsyslog process information
53
            result = subprocess.run(['pgrep', '-f', 'rsyslogd'],
54
                                  capture_output=True, text=True)
55
            if result.returncode == 0:
56
                pid = result.stdout.strip().split('\n')[0]
57

58
                # Memory usage
59
                with open(f'/proc/{pid}/status', 'r') as f:
60
                    for line in f:
61
                        if line.startswith('VmRSS:'):
62
                            memory_kb = int(line.split()[1])
63
                            stats['memory_usage_mb'] = memory_kb / 1024
64
                            break
65

66
                # CPU usage
67
                result = subprocess.run(['ps', '-p', pid, '-o', 'pcpu='],
68
                                      capture_output=True, text=True)
69
                if result.returncode == 0:
70
                    stats['cpu_usage_percent'] = float(result.stdout.strip())
71

72
                # File descriptor count
73
                fd_dir = f'/proc/{pid}/fd'
74
                if os.path.exists(fd_dir):
75
                    stats['open_file_descriptors'] = len(os.listdir(fd_dir))
76

77
            # Log file sizes
78
            log_files = [
79
                '/var/log/syslog',
80
                '/var/log/auth.log',
81
                '/var/log/daemon.log',
82
                '/var/log/kern.log'
83
            ]
84

85
            total_log_size = 0
86
            for log_file in log_files:
87
                if os.path.exists(log_file):
88
                    size = os.path.getsize(log_file)
89
                    total_log_size += size
90
                    stats[f'{os.path.basename(log_file)}_size_mb'] = size / (1024 * 1024)
91

92
            stats['total_log_size_mb'] = total_log_size / (1024 * 1024)
93

94
            # Network connections
95
            result = subprocess.run(['netstat', '-tn'], capture_output=True, text=True)
96
            if result.returncode == 0:
97
                connections = result.stdout.split('\n')
98
                rsyslog_connections = [line for line in connections if ':514' in line]
99
                stats['active_connections'] = len(rsyslog_connections)
100

101
            # Disk space
102
            result = subprocess.run(['df', '/var/log'], capture_output=True, text=True)
103
            if result.returncode == 0:
104
                lines = result.stdout.strip().split('\n')
105
                if len(lines) > 1:
106
                    fields = lines[1].split()
107
                    used_percent = int(fields[4].rstrip('%'))
108
                    stats['disk_usage_percent'] = used_percent
109

110
        except Exception as e:
111
            print(f"Error collecting stats: {e}")
112

113
        return stats
114

115
    def store_metrics(self, metrics):
116
        """Store metrics in database"""
117
        conn = sqlite3.connect(self.db_path)
118
        cursor = conn.cursor()
119

120
        hostname = subprocess.run(['hostname'], capture_output=True, text=True).stdout.strip()
121

122
        for metric_name, value in metrics.items():
123
            cursor.execute(
124
                'INSERT INTO metrics (metric_name, metric_value, hostname) VALUES (?, ?, ?)',
125
                (metric_name, value, hostname)
126
            )
127

128
        conn.commit()
129
        conn.close()
130

131
    def check_alerts(self, metrics):
132
        """Check for alert conditions"""
133
        alerts = []
134

135
        # Memory usage alert
136
        if metrics.get('memory_usage_mb', 0) > 1024:  # 1GB
137
            alerts.append({
138
                'type': 'high_memory_usage',
139
                'message': f"High memory usage: {metrics['memory_usage_mb']:.1f}MB",
140
                'severity': 'warning'
141
            })
142

143
        # CPU usage alert
144
        if metrics.get('cpu_usage_percent', 0) > 80:
145
            alerts.append({
146
                'type': 'high_cpu_usage',
147
                'message': f"High CPU usage: {metrics['cpu_usage_percent']:.1f}%",
148
                'severity': 'warning'
149
            })
150

151
        # Disk space alert
152
        if metrics.get('disk_usage_percent', 0) > 90:
153
            alerts.append({
154
                'type': 'high_disk_usage',
155
                'message': f"High disk usage: {metrics['disk_usage_percent']}%",
156
                'severity': 'critical'
157
            })
158

159
        # Log file size alert
160
        if metrics.get('total_log_size_mb', 0) > 10240:  # 10GB
161
            alerts.append({
162
                'type': 'large_log_files',
163
                'message': f"Large log files: {metrics['total_log_size_mb']:.1f}MB",
164
                'severity': 'warning'
165
            })
166

167
        # Store alerts
168
        if alerts:
169
            conn = sqlite3.connect(self.db_path)
170
            cursor = conn.cursor()
171

172
            for alert in alerts:
173
                cursor.execute(
174
                    'INSERT INTO alerts (alert_type, message, severity) VALUES (?, ?, ?)',
175
                    (alert['type'], alert['message'], alert['severity'])
176
                )
177

178
            conn.commit()
179
            conn.close()
180

181
        return alerts
182

183
    def generate_report(self, hours=24):
184
        """Generate monitoring report"""
185
        conn = sqlite3.connect(self.db_path)
186
        cursor = conn.cursor()
187

188
        # Get recent metrics
189
        since_time = datetime.now() - timedelta(hours=hours)
190
        cursor.execute('''
191
            SELECT metric_name, AVG(metric_value) as avg_value,
192
                   MAX(metric_value) as max_value, MIN(metric_value) as min_value
193
            FROM metrics
194
            WHERE timestamp > ?
195
            GROUP BY metric_name
196
        ''', (since_time,))
197

198
        metrics_summary = cursor.fetchall()
199

200
        # Get recent alerts
201
        cursor.execute('''
202
            SELECT alert_type, COUNT(*) as count, severity
203
            FROM alerts
204
            WHERE timestamp > ?
205
            GROUP BY alert_type, severity
206
        ''', (since_time,))
207

208
        alerts_summary = cursor.fetchall()
209

210
        conn.close()
211

212
        # Generate report
213
        report = {
214
            'timestamp': datetime.now().isoformat(),
215
            'period_hours': hours,
216
            'metrics_summary': {
217
                row[0]: {
218
                    'average': row[1],
219
                    'maximum': row[2],
220
                    'minimum': row[3]
221
                } for row in metrics_summary
222
            },
223
            'alerts_summary': {
224
                f"{row[0]}_{row[2]}": row[1] for row in alerts_summary
225
            }
226
        }
227

228
        return report
229

230
    def run_monitoring(self, interval=60):
231
        """Run continuous monitoring"""
232
        print(f"Starting RSyslog monitoring (interval: {interval}s)")
233

234
        while True:
235
            try:
236
                # Collect metrics
237
                metrics = self.collect_rsyslog_stats()
238
                print(f"[{datetime.now()}] Collected {len(metrics)} metrics")
239

240
                # Store metrics
241
                self.store_metrics(metrics)
242

243
                # Check for alerts
244
                alerts = self.check_alerts(metrics)
245
                if alerts:
246
                    print(f"Generated {len(alerts)} alerts")
247
                    for alert in alerts:
248
                        print(f"  {alert['severity'].upper()}: {alert['message']}")
249

250
                time.sleep(interval)
251

252
            except KeyboardInterrupt:
253
                print("\nMonitoring stopped")
254
                break
255
            except Exception as e:
256
                print(f"Error in monitoring loop: {e}")
257
                time.sleep(interval)
258

259
def main():
260
    parser = argparse.ArgumentParser(description='RSyslog Monitoring Dashboard')
261
    parser.add_argument('--interval', type=int, default=60,
262
                      help='Monitoring interval in seconds (default: 60)')
263
    parser.add_argument('--report', action='store_true',
264
                      help='Generate and display report')
265
    parser.add_argument('--hours', type=int, default=24,
266
                      help='Report period in hours (default: 24)')
267

268
    args = parser.parse_args()
269

270
    monitor = RSyslogMonitor()
271

272
    if args.report:
273
        report = monitor.generate_report(args.hours)
274
        print(json.dumps(report, indent=2))
275
    else:
276
        monitor.run_monitoring(args.interval)
277

278
if __name__ == '__main__':
279
    main()