Re: [rsyslog] RHEL-7.9 rsyslog with FileOwner

2024-04-15 Thread Attila Lakatos via rsyslog
Hello, On Thu, Apr 11, 2024 at 1:34 AM warron.french via rsyslog < rsyslog@lists.adiscon.com> wrote: > Sir, David, as there anything else you needed from me? > The legacy way to set owner/group of files is to use something like the following: $FileOwner nameOfTheOwner $FileGroup nameOfTheGroup

[rsyslog] Possibility to introduce a new log crypto provider

2024-04-15 Thread Attila Lakatos via rsyslog
Hello, Currently, log messages written to files can undergo encryption using the libgcrypt cryptographic library [1]. This works fine, logs can be encoded and successfully decoded but I think the library has some drawbacks: - algorithms are hardcoded, if someone would want to use something els

Re: [rsyslog] Possibility to introduce a new log crypto provider

2024-04-15 Thread Rainer Gerhards via rsyslog
Sound good to me, as long as everything is backwards-compatible ;-) Else we need to discuss pro and con (I guess there a lot of pro!) Rainer El lun, 15 abr 2024 a las 11:55, Attila Lakatos via rsyslog () escribió: > > Hello, > > Currently, log messages written to files can undergo encryption us

Re: [rsyslog] RHEL-7.9 rsyslog with FileOwner

2024-04-15 Thread warron.french via rsyslog
At Mariusz, my apologies for not replying earlier, somehow Google Mail crunched your reply in the thread so that I did not see it (*laziness on my part I guess, I have been extremely busy at work*). I just executed *ps -ef | egrep rsyslog* and see that rsyslog is running as root. Can I assume tha

Re: [rsyslog] RHEL-7.9 rsyslog with FileOwner

2024-04-15 Thread warron.french via rsyslog
Did you not see the full config? I provided it as an image. Was the image blocked at your end, from being received? -- Warron French On Sat, Apr 6, 2024 at 3:04 AM David Lang via rsyslog < rsyslog@lists.adiscon.com> wrote: > it's common for rsyslog configs to drop pri

Re: [rsyslog] RHEL-7.9 rsyslog with FileOwner

2024-04-15 Thread warron.french via rsyslog
At David, Mariusz, and Attila, here is my attempt to provide the syntax (again). I am thinking you might not have received it because it came in image form before. Snippets of my Rsyslog.conf $ModLoad imudp $UDPServerRun 514 ## UDG-specific; Start # $ModLoad omfile; Wfrench;

Re: [rsyslog] RHEL-7.9 rsyslog with FileOwner

2024-04-15 Thread Rainer Gerhards via rsyslog
Which error messages do you see? Rainer Sent from phone, thus brief. warron.french via rsyslog schrieb am Mo., 15. Apr. 2024, 15:52: > At Mariusz, my apologies for not replying earlier, somehow Google Mail > crunched your reply in the thread so that I did not see it (*laziness on my > part I g

Re: [rsyslog] RHEL-7.9 rsyslog with FileOwner

2024-04-15 Thread Mariusz Kruk via rsyslog
I see you're trying to send data to Splunk and thus probably want the files read as a user running the Universal Forwarder. Instead of writing files locally you can send them straight to HEC input using the omhttp module. (which gives you additional flexibility since you can dynamically overwr