Documentation
¶
Overview ¶
Package syslog is the audit sink adapter for a syslog collector (R-382, design 12 §5.1): RFC 5424 messages over TCP, octet-counted as RFC 5425 and RFC 6587 frame them, with TLS unless the operator turns it off.
Each event is one message. Its MSG is the event as core encoded it, its MSGID the action, and its structured data the event's id and outcome, so a collector can deduplicate a redelivered event (delivery is at least once).
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) AuditSinkCapabilities() api.AuditSinkCapabilities
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(_ context.Context, raw json.RawMessage) error
- func (a *Adapter) HealthCheck(ctx context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) Send(ctx context.Context, b api.AuditBatch) error
- type Config
- type Credentials
Constants ¶
const DefaultMaxBatch = 200
DefaultMaxBatch is how many events one Send carries unless max_batch says.
const Kind = "syslog"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter sends to one collector over one connection, reused between batches.
func (*Adapter) AuditSinkCapabilities ¶
func (a *Adapter) AuditSinkCapabilities() api.AuditSinkCapabilities
AuditSinkCapabilities reports how core feeds this adapter (R-254).
func (*Adapter) HealthCheck ¶
HealthCheck connects, completes the TLS handshake, and hangs up. It sends nothing: a test message would be an event the collector indexes.
Under TLS 1.3 the client's handshake finishes before the server has judged its certificate, so a collector refusing it says so only afterward. A short read waits for that: a collector never writes, so running out of time is the healthy answer, and anything else — an alert, a hang-up — is not.
type Config ¶
type Config struct {
Credentials Credentials `json:"credentials,omitzero"`
sinkkit.Common
Address string `json:"address,omitempty"`
TLS string `json:"tls,omitempty"`
CACertificate string `json:"ca_certificate,omitempty"`
ServerName string `json:"server_name,omitempty"`
AppName string `json:"app_name,omitempty"`
Facility string `json:"facility,omitempty"`
Hostname string `json:"hostname,omitempty"`
TimeoutSeconds int `json:"timeout_seconds,omitempty"`
}
Config is the adapter's configuration.
type Credentials ¶
type Credentials struct {
ClientCertificate secret.Value `json:"client_certificate,omitzero"`
ClientKey secret.Value `json:"client_key,omitzero"`
}
Credentials is what this adapter keeps secret: a client certificate and its key, for a collector that requires mutual TLS. The certificate is not secret, but it is useless without the key and is set beside it.
Source Files