Graylog: Send rsyslog logs to Graylog using TLS encryption

This documentation is part of the Getting started guide. View the full guide here: How to get started with Graylog.

👋 Welcome to Stackhero documentation

Stackhero provides a fully managed Graylog cloud solution designed for speed and simplicity. You can:

• Rely on an unlimited, dedicated SMTP email server included with your service.
• Apply updates effortlessly with a single click, with no manual intervention needed.
• Use a custom domain name secured by HTTPS (for example, https://logs.your-company.com), giving your team secure, direct access.
• Experience strong performance and security on a private, dedicated infrastructure with no shared resources or noisy neighbors.

Focus on your data, not your tooling: you can get started with Stackhero's Graylog cloud hosting solution in just a few minutes.

If you have an rsyslog client and want to send logs securely to Graylog, follow these steps:

Do not activate any TLS option on Graylog's input. TLS will be managed directly by a reverse proxy on your instance so that Graylog does not handle it.

1. Go to your Graylog service configuration in the Stackhero dashboard and enable "TLS encryption" for the Syslog TCP port 514.

2. Update your rsyslog configuration as outlined below. Replace <XXXXXX>.stackhero-network.com with your instance hostname:

   # Define TLS CA certificate
   global(
     DefaultNetstreamDriver="gtls"
     DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt"
   )
   
   # Send all logs to a remote server
   # An on-disk queue is created for this action. If the remote host is
   # down, messages are spooled to disk and sent when it becomes available again
   # See https://www.rsyslog.com/doc/v8-stable/configuration/actions.html
   # and https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfwd.html
   *.* action(
     type="omfwd"
     target="<XXXXXX>.stackhero-network.com"
     port="514"
     protocol="tcp"
     KeepAlive="on"
     KeepAlive.Interval="30"
     StreamDriver="gtls"
     StreamDriverMode="1"
     StreamDriverAuthMode="x509/name"
     ResendLastMSGOnReconnect="on"
     queue.filename="fwdRule1"  # unique name prefix for spool files
     queue.type="LinkedList"
     queue.maxDiskSpace="256m"
     queue.saveOnShutdown="on"
     action.resumeRetryCount="-1"
     action.resumeInterval="30"
   )
   

3. Restart your rsyslog service and verify the configuration by sending a log using the command:

   logger This is a test
   

This completes the setup. You are now securely sending logs to Graylog using TLS encryption!