Syslog forwarding with SSL

When log messages are forwarded to a syslog server using SSL, the server certificate is verified against the local system CAs. The local system CA bundle is stored under:

 
Example
/etc/pki/tls/certs/ca-bundle.crt

When using SSL, log messages can be sent to destination port 6514. An alternative port can be configured.

If the syslog server uses a self-signed server certificate or a certificate issued by your own root CA, you must provide the corresponding CA certificate locally. Place the CA certificate file under:

 
Example
/opt/airlock/custom-settings/syslog-ng/ca/<server-name>.crt

The <server-name> part of the file name must exactly match the configured log host. This means:

  • If the configured log host is specified as FQDN, use the FQDN in the certificate file name, e.g.:
  •  
    Terminal box
    /opt/airlock/custom-settings/syslog-ng/ca/loghost.example.com.crt
  • If the configured log host is a host name without domain, use only that host name in the certificate file name, e.g.:
  •  
    Terminal box
    /opt/airlock/custom-settings/syslog-ng/ca/loghost.crt

Forwarding to multiple log hosts

If forwarding to multiple log hosts is configured, the CA certificate file in the local certificate storage path must be named after the first configured log host.

Example with the first configured log host loghost-remote1.example.com:

 
Terminal box
/opt/airlock/custom-settings/syslog-ng/ca/loghost-remote1.example.com.crt

The certificate file must contain the CA certificates required to verify the certificates of all configured log hosts.

Example:

  • CA certificate for loghost-remote1.example.com
  • CA certificate for loghost-remote2.example.com

The file name must follow the same naming rule as for a single log host: it must exactly match the first configured log host, regardless of whether that log host is configured as an FQDN or as a host name only.