tls-production.conf

# Production-Ready TLS Configuration
# Recommended settings for production environments
# Features: Strict certificate validation, connection persistence, retry logic

[Network]
# Remote syslog server (replace with your actual server)
Address=logs.prod.example.com:6514

# TLS protocol for encryption
Protocol=tls

# RFC 5425 format (length-prefixed for TLS, prevents message truncation)
LogFormat=rfc5425

# STRICT certificate validation (reject any invalid certificates)
# Never use 'warn' or 'allow' in production!
TLSCertificateAuthMode=deny

# Path to CA certificate bundle
# Debian/Ubuntu: /etc/ssl/certs/ca-certificates.crt
# RHEL/CentOS: /etc/pki/tls/certs/ca-bundle.crt
# Alpine: /etc/ssl/certs/ca-certificates.crt
TLSServerCertificate=/etc/pki/tls/certs/ca-bundle.crt

# TCP connection optimizations
KeepAlive=yes           # Detect broken connections
NoDelay=yes             # Disable Nagle's algorithm for low latency

# Retry connection every 30 seconds if it fails
ConnectionRetrySec=30

# Filter out noisy debug and info messages to reduce volume
ExcludeSyslogLevel=debug info

# Exclude authentication logs (may contain sensitive credentials)
ExcludeSyslogFacility=auth authpriv

# Add production metadata to all messages
StructuredData=[origin@32473 environment="production" version="1.4"]

# Optional: Only forward logs from specific journal namespace
# Namespace=production

# Validation checklist before deploying:
# [ ] Replace logs.prod.example.com with your actual server
# [ ] Verify TLSServerCertificate path is correct for your OS
# [ ] Test certificate validation: openssl s_client -connect logs.prod.example.com:6514
# [ ] Confirm firewall allows outbound connections to port 6514
# [ ] Set up monitoring for systemd-netlogd service health
# [ ] Configure alerts for certificate expiration
# [ ] Test failover if your logging infrastructure supports it