Logging to (r)syslog from Shib v3 via logback

[Greg Haverkamp]

On Thu, Sep 8, 2016 at 7:52 AM, Greg Haverkamp <gahaverkamp at lbl.gov> wrote:

>
> On Thu, Sep 8, 2016 at 7:22 AM, Mark Cairney <Mark.Cairney at ed.ac.uk>
> wrote:
>
>> Has anyone got this working successfully who can point out where I'm
>> going wrong?
>>
>
> To start with the issue that's tripped me up a couple of times... Is your
> rsyslogd listening for connections on localhost?
>

For what it's worth, I started looking into my syslog configuration,
because I couldn't figure out/remember how the audit logs were ending up in
our cyber security group's central syslog server.  I used to syslog
directly out of the IdP.  At some point, I changed, though I can't remember
why.  But after some puzzlement, I finally discovered what I had done.  I'm
using rsyslog on our Docker container hosts to forward the audit logs:

$ModLoad imfile
$InputFileName /var/data/production-idp/logs/shibboleth-idp/idp-audit.log
$InputFileTag idp-audit
$InputFileStateFile state-idp-audit
$InputFileFacility local6
$InputRunFileMonitor

In turn, local6.* (which also gets warn and process) gets forwarded to both
our IAM syslog and cybersecurity syslog hosts (which actually gets *.*)

I must have thought it was a good idea, but in our containerized
environment and with whatever aspirations we have of throwing containers
about at will, it's not very sustainable.

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160908/124f1691/attachment.html>