Welcome to Remote Syslog documentation!

Remote Syslog documention holds all documentation of the Remote Syslog products. More information can be found on https://www.remotesyslog.com/

This is a part of the masterscript: https://www.github.com/tslenter/RS

Check out the 2.1 Installation RSE core section for further information about the installation, including how to 3. Usage CLI or 4. Usage GUI the project.

Note

This product is free and given without any warrenty. If you notice any fault, bug or security issue, please contact us via mail: info@remotesyslog.com.

Contents

• 1. Requirements
  • 1.1 Supported operating systems
  • 1.2 Tested hardware
  • 1.3 Bare-metal / Virtual machine
• 2. Installation instuctions
  • 2.1 Installation RSE core
  • 2.2 Installation RSC core
  • 2.3 Installation RSE webinterface
  • 2.4 Installation RSC webinterface
  • 2.5 Installation RSX webinterface
  • 2.6 Installation RSL webinterface (Clean project)
  • 2.7 Installation RSL webinterface (Backup project)
  • 2.8 Installation RSE for docker on Synology
    • 2.8.1 Download image
    • 2.8.2 Install image
    • 2.8.3 Configure network
    • 2.8.4 Check summary
    • 2.8.5 Known error afer apply
    • 2.8.6 Known limitation
    • 2.8.7 Default login
  • 2.9 Docker image creation from scratch
    • 2.9.1 Prepare docker image
    • 2.9.2 Create docker image
• 3. Usage CLI
  • 3.1 RSE viewer (rseview)
    • 3.1.1 Display help
    • 3.1.2 Display logging with search string
    • 3.1.3 Display logging
    • 3.1.4 Display live logging
    • 3.1.5 Display live logging with search string
    • 3.1.6 Generate test message
    • 3.1.7 Clear all logging
    • 3.1.8 Change policy
    • 3.1.9 Display policy
    • 3.1.10 Display index / shard info
    • 3.1.11 Display cluster / server info
    • 3.1.12 Display usage
    • 3.1.13 Authentication for RSEVIEW
    • 3.1.14 Filter on date and string
  • 3.2 RSC viewer (rsview)
    • 3.2.1 Display help
    • 3.2.2 Display logging with search string
    • 3.2.3 Display logging
    • 3.2.4 Display live logging
    • 3.2.5 Display live logging with search string
    • 3.2.6 Generate test message
    • 3.2.7 Clear all logging
  • 3.3 RSE user management (rseuser)
    • 3.3.1 Add user
    • 3.3.2 Remove user
  • 3.4 RSC user management (rsuser)
    • 3.4.1 Add user
    • 3.4.2 Remove user
  • 3.5 Python module
    • 3.5.1 Requirements
    • 3.5.2 Installation
    • 3.5.3 Example with Cisco DNA Controller
    • 3.5.4 Available facility
    • 3.5.5 Available levels
    • 3.5.6 Most basic code (Example)
  • 3.6 Remote Syslog Programmer
    • 3.6.1 Installation
    • 3.6.2 Usage
  • 3.7 RSEDUMPER
    • 3.7.1 Installation
    • 3.7.2 Usage
• 4. Usage GUI
  • 4.1 GUI Requirements
  • 4.2 RSE GUI usage
    • 4.2.1 RSE Login
    • 4.2.2 RSE dashboard
    • 4.2.3 RSE text viewer
    • 4.2.4 RSE menu
    • 4.2.5 RSE options
    • 4.2.6 RSE searchbar
    • 4.2.7 RSE searchbar example searchstrings
  • 4.3 RSX GUI usage
    • 4.3.1 RSX Login
    • 4.3.2 RSX dashboard
    • 4.3.3 RSX logout
  • 4.4 RSC GUI usage
    • 4.4.1 RSC Login
    • 4.4.2 RSC livelog selection
    • 4.4.3 RSC text viewer
    • 4.4.4 RSC menu
    • 4.4.5 RSC options
    • 4.4.6 RSC filter
• 5. Deinstallation
  • 5.1 Deinstallation RSE core
  • 5.2 Deinstallation RSC core
  • 5.3 Deinstallation RSE webinterface
  • 5.4 Deinstallation RSC webinterface
  • 5.5 Deinstallation RSX webinterface
  • 5.6 Deinstallation RSL webinterface (Any project)
  • 5.7 Deinstallation rseinstaller
• 6. Upgrade
  • 6.1 Upgrade RSE core
  • 6.2 Upgrade RSC core
  • 6.3 Upgrade RSE webinterface
  • 6.4 Upgrade RSC webinterface
  • 6.5 Upgrade RSX webinterface
  • 6.6 Upgrade RSL webinterface (Any project)
  • 6.7 Upgrade from legacy Remote Syslog
  • 6.8 Upgrade to new distrobution
  • 6.9 Preparations for Elastic 8.x
  • 6.10 Ubuntu upgrade policy
• 7. Additional configuration
  • 7.1 Active Directory integration via PAM
  • 7.2 Integrate Active Directory LDAP authentication for Apache 2
  • 7.3 Basic authentication for Apache 2
  • 7.4 Generate an email from an event (Only RSC)
  • 7.5 Generate an email from an event (Only RSE)
  • 7.6 Generate an email from an event using python (Only RSE)
• 8. Additional commands
  • 8.1 RSE Core commands
    • 8.1.1 Check the cluster health
    • 8.1.2 Speed up lifecycly policy check
    • 8.1.3 Set lifecycly policy speed to default
    • 8.1.4 List indexes
    • 8.1.5 Check cluster diskspace
    • 8.1.6 Filter on host and time
    • 8.1.7 View top 10 results
    • 8.1.8 View the mapping of the fields
    • 8.1.9 Search between times
    • 8.1.10 Search uniq MAC adresses from DHCP index
    • 8.1.11 View 2 exact terms
    • 8.1.12 View 1 exact term
    • 8.1.13 Flush indexes
    • 8.1.14 Delete index
    • 8.1.15 View license
    • 8.1.16 Lite search a value on multiple fields
    • 8.1.17 Lite search a single value for 1 field
    • 8.1.18 Example searches
    • 8.1.19 Advanced searches
    • 8.1.20 Validate query’s
    • 8.1.21 Sort results
    • 8.1.22 Indexes and aliases
    • 8.1.23 Refresh indexes
    • 8.1.24 Example lifecycle policy
    • 8.1.25 Dump latest 10000 results sorted to the CLI
  • 8.2 RSC Core commands
    • 8.2.1 Search multiple strings of text
    • 8.2.2 Search for the top 15 messages
  • 8.3 Unsupported commands
    • 8.3.1 Disable NTP and change date
• 9. Configuration Files
  • 9.1 Config files locations
    • 9.1.1 Default RSC Core configuration/files
    • 9.1.2 Default RSE Core configuration/files:
    • 9.1.3 Default RSX web configuration/files
    • 9.1.4 Default Plugin configuration/files:
  • 9.2 Config checks
    • 9.2.1 Logstash test new config
• 10. Security
  • 10.1 Certificate location and replacement
  • 10.2 RS4LOGJ-CVE-2021-44228
    • 10.2.1 Upgrade to recommended version
    • 10.2.2 Mitigation without upgrade
• 11. WAF Web Application Firewall
  • 11.1 WAF Requirements
  • 11.2 File download locations
  • 11.3 IIS Module installation
    • 11.3.1 Visual C++ Redistributable Packages installation
    • 11.3.2 ModSecurity installation
    • 11.3.3 WinLogBeat installation
    • 11.3.4 Filebeat installation
    • 11.3.5 ModSecurity Configuration
    • 11.3.6 WinLogBeat Configuration
    • 11.3.7 FileBeat Configuration
• 12. FAQ
  • 12.1 My RSX/RSE installation does not recieve any logging
  • 12.2 Disk full by Geo2
  • 12.3 Kibana not loaded after upgrade
  • 12.4 Data too large, data for [<http_request>] (JVM heap size)
  • 12.5 Syslog-NG 3.27.1 breaks with new upgrade on Ubuntu 18.04 and 20.04
  • 12.6 How to resolve a full disk