diff --git a/CHANGELOG b/CHANGELOG index 904a6be9b..615e6756e 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -6,6 +6,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added +- [SERVICES] [RSYSLOGD] Output queues in default rulesets ## [2.34.4] - 2025-12-17 diff --git a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_generic_json/ruleset.conf b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_generic_json/ruleset.conf index e77df96b0..654e9a9ff 100644 --- a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_generic_json/ruleset.conf +++ b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_generic_json/ruleset.conf @@ -15,6 +15,14 @@ lookup_table(name="{{f_reputation_ctx.reputation_ctx.filename}}" file="{{f_reput {{ frontend.pre_ruleset }} +ruleset(name="{{ frontend.ruleset_name }}_outputs" queue.type="Direct") { + {{ frontend.log_condition }} +} + +ruleset(name="{{ frontend.ruleset_name }}_outputs_garbage" queue.type="Direct") { + {{ frontend.log_condition_failure }} +} + {% if frontend.rendered_custom_actions -%} ruleset(name="{{ frontend.ruleset_name }}_custom_actions" queue.type="Direct") { {{ frontend.rendered_custom_actions|indent(4, false) }} @@ -91,11 +99,10 @@ ruleset(name="{{ frontend.ruleset_name }}" {{ frontend.ruleset_options|safe }}) {{ frontend.log_condition }} - action(type="omfile" DynaFile="recoveryfile" CreateDirs="on" action.ExecOnlyWhenPreviousIsSuspended="on" template="raw_message") + call {{ frontend.ruleset_name }}_outputs stop } else { - {{ frontend.log_condition_failure }} - #We need at least a directive here - to prevent rsyslog error + call {{ frontend.ruleset_name }}_outputs_garbage stop } } diff --git a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy/ruleset.conf b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy/ruleset.conf index 244c9ba97..60afbb7b6 100644 --- a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy/ruleset.conf +++ b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy/ruleset.conf @@ -20,6 +20,18 @@ }] }-%} +ruleset(name="{{ frontend.ruleset_name }}_outputs" queue.type="Direct") { + {{ frontend.log_condition|indent(4, false) }} +} + +ruleset(name="{{ frontend.ruleset_name }}_outputs_garbage" queue.type="Direct") { + action(type="omfile" + File="/var/log/haproxy/{{frontend.name}}.log" + # FIXME : Add dirOwner, dirGroup, fileOwner, fileGroup, dirCreateMode, fileCreateMode + flushInterval="1" + asyncWriting="on") +} + {% if frontend.rendered_custom_actions -%} ruleset(name="{{ frontend.ruleset_name }}_custom_actions" queue.type="Direct") { {{ frontend.rendered_custom_actions|indent(4, false) }} @@ -112,8 +124,6 @@ ruleset(name="{{ frontend.ruleset_name }}" {{ frontend.ruleset_options|safe }}) cache_size="{{frontend.mmdb_cache_size}}") {%- endif %} - set $!frontend_name = "{{frontend.name}}"; - # Convert timestamp from epoch to rfc3339 set $!timestamp = replace(format_time(field($!time, ".", 1), "date-rfc3339"), "Z", "." & field($!time, ".", 2) & "Z"); @@ -121,16 +131,10 @@ ruleset(name="{{ frontend.ruleset_name }}" {{ frontend.ruleset_options|safe }}) {% include "rsyslog_darwin/ruleset.conf" %} - {{ frontend.log_condition }} - + call {{ frontend.ruleset_name }}_outputs stop - - # If other logs } else { - action(type="omfile" - File="/var/log/haproxy/{{frontend.name}}.log" - # FIXME : Add dirOwner, dirGroup, fileOwner, fileGroup, dirCreateMode, fileCreateMode - flushInterval="1" - asyncWriting="on") + call {{ frontend.ruleset_name }}_outputs_garbage + stop } } diff --git a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy_tcp/ruleset.conf b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy_tcp/ruleset.conf index 1e5d17699..4ca357b4d 100644 --- a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy_tcp/ruleset.conf +++ b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_haproxy_tcp/ruleset.conf @@ -20,6 +20,18 @@ }] }-%} +ruleset(name="{{ frontend.ruleset_name }}_outputs" queue.type="Direct") { + {{ frontend.log_condition }} +} + +ruleset(name="{{ frontend.ruleset_name }}_outputs_garbage" queue.type="Direct") { + action(type="omfile" + File="/var/log/haproxy/{{frontend.name}}.log" + # FIXME : Add dirOwner, dirGroup, fileOwner, fileGroup, dirCreateMode, fileCreateMode + flushInterval="1" + asyncWriting="on") +} + {% if frontend.rendered_custom_actions -%} ruleset(name="{{ frontend.ruleset_name }}_custom_actions" queue.type="Direct") { {{ frontend.rendered_custom_actions|indent(4, false) }} @@ -92,20 +104,17 @@ ruleset(name="{{ frontend.ruleset_name }}" {{ frontend.ruleset_options|safe }}) cache_size="{{frontend.mmdb_cache_size}}") {%- endif %} + # Convert timestamp from epoch to rfc3339 + set $!timestamp = replace(format_time(field($!time, ".", 1), "date-rfc3339"), "Z", "." & field($!time, ".", 2) & "Z"); + {% if frontend.rendered_custom_actions %}call {{ frontend.ruleset_name }}_custom_actions{% endif %} {% include "rsyslog_darwin/ruleset.conf" %} - {{ frontend.log_condition }} - + call {{ frontend.ruleset_name }}_outputs stop - - # If other logs } else { - action(type="omfile" - File="/var/log/haproxy/{{frontend.name}}.log" - # FIXME : Add dirOwner, dirGroup, fileOwner, fileGroup, dirCreateMode, fileCreateMode - flushInterval="1" - asyncWriting="on") + call {{ frontend.ruleset_name }}_outputs_garbage + stop } } diff --git a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_raw_to_json/ruleset.conf b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_raw_to_json/ruleset.conf index 9ff86b276..fd491a151 100644 --- a/vulture_os/services/rsyslogd/config/rsyslog_ruleset_raw_to_json/ruleset.conf +++ b/vulture_os/services/rsyslogd/config/rsyslog_ruleset_raw_to_json/ruleset.conf @@ -8,6 +8,14 @@ {{ frontend.pre_ruleset }} +ruleset(name="{{ frontend.ruleset_name }}_outputs" queue.type="Direct") { + {{ frontend.log_condition|indent(4, false) }} +} + +ruleset(name="{{ frontend.ruleset_name }}_outputs_garbage" queue.type="Direct") { + {{ frontend.log_condition_failure|indent(4, false) }} +} + {% if frontend.rendered_custom_actions -%} ruleset(name="{{ frontend.ruleset_name }}_custom_actions" queue.type="Direct") { {{ frontend.rendered_custom_actions|indent(4, false) }} @@ -23,9 +31,7 @@ ruleset(name="{{ frontend.ruleset_name }}" {{ frontend.ruleset_options|safe }}) {% include "rsyslog_darwin/ruleset.conf" %} - {{ frontend.log_condition }} - - action(type="omfile" DynaFile="recoveryfile" CreateDirs="on" action.ExecOnlyWhenPreviousIsSuspended="on" template="raw_message") + call {{ frontend.ruleset_name }}_outputs stop }