Syslog Settings
It’s possible to have StoredSafe send appliance information to a remote syslog server. By default it’s disabled.
Two transport methods are available and can be configured independently of each other:
Legacy — plain UDP or TCP syslog forwarding to a single remote host.
RELP (Reliable Event Logging Protocol) — TLS-encrypted, mutually authenticated forwarding to up to 5 destination servers, with delivery acknowledged by the receiving server.
┌────────────────────────────────────────────────────────────────────────────┐
│ Network Settings on node1 (Version X.X.X build XXXX) │
└────────────────────────────────────────────────────────────────────────────┘
┌─┬──────────────────────────────────────────────────────────────────────────┐
│1│Syslog (Legacy) Configuration │
│2│Syslog (RELP) Configuration │
└─┴──────────────────────────────────────────────────────────────────────────┘
Move the cursor or enter a it's corresponding number (Q to Quit)
Main> System Settings> Network> Syslog>
Note
The two methods are independent and can be enabled at the same time; each forwards the same appliance log events to its own destination(s).
Syslog (Legacy) Configuration
┌────────────────────────────────────────────────────────────────────────────┐
│ Network Settings on node1 (Version X.X.X build XXXX) │
└────────────────────────────────────────────────────────────────────────────┘
┌─┬──────────────────────────────────────────────────────────────────────────┐
│1│View the remote syslog settings │
│2│Change the remote syslog host │
│3│Change the remote syslog port │
│4│Change the remote syslog protocol (UDP or TCP) │
│5│Enable or Disable remote syslog │
│6│Restart the syslog server │
│7│Log level for remote logging │
└─┴──────────────────────────────────────────────────────────────────────────┘
Move the cursor or enter a it's corresponding number (Q to Quit)
Main> System Settings> Network> Syslog> Legacy>
View the remote syslog settings
Check the status on sending system logs to a remote syslog server. Shows current remote syslog status (host, port and protocol).
Remote syslog is DISABLED.
Press any key to continue
Change the remote syslog host
Configure what remote syslog server to use. Currently only one remote syslog server is supported.
Specify remote syslog server? (Q to Quit) <none>: 192.168.1.124
Press any key to continue
Change the remote syslog port
If the remote syslog server is listening on a non default port, it can be specified here.
Specify port for remote syslog server? (Q to Quit) <none>: 514
Press any key to continue
Change the remote syslog protocol (UDP or TCP)
It’s possible to send syslog via UDP (default) or TCP.
Specify protocol for remote syslog server? (UDP or TCP) (Q to Quit) <udp>: tcp
Press any key to continue
Enable or Disable remote syslog
Enable or disable the sending of logs to a remote server.
Remote syslog is DISABLED.
Enable remote syslog? (<Y>/n):
Restart syslog to activate changes? (<Y>/n):
rsyslog stop/waiting
rsyslog start/running, process 2872
Remote syslog is ENABLED.
Remote syslog server is set to 192.168.1.124 on port 514 using udp.
Press any key to continue
Restart the syslog server
Restart the local syslog server.
rsyslog stop/waiting
rsyslog start/running, process 2928
Remote syslog is ENABLED.
Remote syslog server is set to 192.168.1.124 on port 514 using udp.
Press any key to continue
Log level for remote logging
Specify if decrypts should be be sent to the remote syslog server. By default, only objects marked with “Alert if decrypted” logged, with this setting all decrypts are logged and sent to the remote syslog server.
Note
The decrypted content is never logged.
If disabled:
Log all decrypts to the remote syslog server "10.6.1.2"? (<Y>/n):
Press any key to continue
If enabled:
Stop logging all decrypts to the remote syslog server "10.6.1.2"? (<Y>/n):
Press any key to continue
Example
Jun 23 17:21:46 stored.safe.cc storedsafe[10744]: "action=alarm" what="x509 (2391)" user="Sven Svensson (29)" source="10.2.9.7"
Jun 23 17:21:53 stored.safe.cc storedsafe[30747]: "action=alarm-decrypted" what="Emergency use only (1339)" user="Ulrich Bauer (29)" source="10.200.1.89"
Syslog (RELP) Configuration
RELP (Reliable Event Logging Protocol) sends log events over a TLS-encrypted, mutually authenticated connection and the receiving server acknowledges that each message has been stored — unlike the legacy UDP/TCP forwarder above, which is fire-and-forget. Use RELP if your organization needs guaranteed delivery of audit events, for example for compliance reasons.
Before configuring RELP you need, from your RELP server infrastructure:
The CA certificate (PEM format) that signed the RELP server’s certificate.
A client certificate (PEM format) and its matching private key, used by StoredSafe to authenticate itself to the RELP server (mutual TLS).
Up to 5 RELP destination servers can be configured. Each server has its own port, TLS authentication method, list of permitted peers and log format template — but all configured servers share the same client certificate, private key and CA certificate.
Reliable Event Logging Protocol (RELP)
RELP is not activated.
Change RELP configuration? (y/<N>): y
RELP compliant Syslog server #0 (. to end input, Q to Quit) <storedsafe>: relp1.corp.com
Port used for RELP on Syslog server #0 "relp1.corp.com" (Q to Quit) <4514>:
TLS auth method for #0 "relp1.corp.com" [name or fingerprint] (Q to quit)? <name>:
TLS permitted peer for #0 "relp1.corp.com" (. to end input, Q to Quit) <relp1.corp.com>:
TLS permitted peer for #0 "relp1.corp.com" (. to end input, Q to Quit) <relp1.corp.com>: .
Template to use for #0 "relp1.corp.com" (Q to quit)? <RSYSLOG_ForwardFormat>:
RELP compliant Syslog server #1 (. to end input, Q to Quit) <storedsafe>: .
A Client Certificate (with private key) and the public key of the CA used to sign the Server Certificates
is required to be able to establish mutual TLS between RELP client and server.
Search for a USB disk? (<Y>/n): n
Ok, using the directory "/isodevice/var/transfer" instead.
CA Certificate used to sign the Server Certificates for RELP? (Q to Quit) <ca.pem>:
Subject: C=se, ST=stockholm, O=Corp INC, CN=Corp Internal CA
Issuer: C=se, ST=stockholm, O=Corp INC, CN=Corp Internal CA
Use this CA Certificate? (<Y>/n): y
Certificate to use as Client Certificate (mTLS) for RELP? (Q to Quit) <client.pem>:
Use this Client Certificate? (<Y>/n): y
Which Private Key file corresponds to "client.pem"? (Q to Quit) <client.key>:
INFO: Client Certificate ("client.pem") matches the Private key ("client.key"). Good.
Use this Private Key? (<Y>/n): y
Install the X.509 Client Certificate (and private key) and CA Certificate required for RELP? (<Y>/n): y
INFO: Installed X.509 Client and CA Certificates successfully.
Configure and activate the new RELP configuration? (<Y>/n): y
Restart the syslog server to activate RELP? (<Y>/n): y
Press any key to continue
Supported TLS authentication methods are:
name— verify the peer using its certificate subject name (default).fingerprint— verify the peer using a specific certificate fingerprint.
Supported log format templates are:
RSYSLOG_ForwardFormat(default)RSYSLOG_TraditionalFileFormatRSYSLOG_FileFormatRSYSLOG_SysklogdFileFormatRSYSLOG_SyslogProtocol23Format
Note
Certificates and the private key are copied to the appliance and stored under
/isodevice/persistent/etc/relp. If a previous set of certificates already exists,
you will be offered to back them up with a .old suffix before they are overwritten.
Removing the RELP configuration
If RELP is already enabled, choosing to change the configuration first shows the current settings and offers to delete the configuration entirely instead:
Reliable Event Logging Protocol (RELP)
RELP Server #0: "relp1.corp.com" on port 4514 (template "RSYSLOG_ForwardFormat")
TLS auth method: name, permitted peers: relp1.corp.com
Certificate used as Client Certificate: /isodevice/persistent/etc/relp/client.pem
CA Certificate used to sign the Server Certificate: /isodevice/persistent/etc/relp/ca.pem
Change RELP configuration? (y/<N>): y
Delete RELP configuration? (y/<N>): y
Are your sure? (y/<N>): y
INFO: RELP configuration deleted.
Restart the syslog server to de-activate RELP? (<Y>/n): y