Feature: log
Description
Provides logging infrastructure including auditd, remote logging via rsyslog-relp, and systemd-journal-remote.
What it does
Installs auditd, rsyslog-relp, and systemd-journal-remote. Configures rsyslog for structured logging and provides a base set of audit rules. Journal configuration is tuned for minimal footprint. Several rsyslog configurations are shipped as .disabled files that can be activated as needed.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
exec.config (ref) | Enables auditd and rsyslog services. |
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
file.include.stat (ref) | Sets file ownership and permissions for log configuration files. |
info.yaml (ref) | Declares type: element and included/excluded features. |
pkg.include (ref) | Installs: auditd, systemd-journal-remote, rsyslog-relp. |
file.include/etc/rsyslog.conf (file.include) | Main rsyslog configuration file. |
file.include/etc/audit/rules.d/10-base-config.rules (file.include) | Base auditd configuration rules applied to all systems. |
file.include/etc/audit/rules.d/12-cont-fail.rules (file.include) | Audit rule to continue processing when a rule fails to load. |
file.include/etc/audit/rules.d/12-ignore-error.rules (file.include) | Audit rule to suppress certain expected errors from the audit log. |
file.include/etc/audit/rules.d/README (file.include) | Documentation for the audit rules directory and rule ordering conventions. |
file.include/etc/rsyslog.d/10-local.conf.disabled (file.include) | Template for local rsyslog output (disabled by default; rename to .conf to activate). |
file.include/etc/rsyslog.d/20-input.conf (file.include) | rsyslog input module configuration. |
file.include/etc/rsyslog.d/21-input-klog.conf.disabled (file.include) | Kernel log input for rsyslog (disabled by default). |
file.include/etc/rsyslog.d/29-input-mark.conf.disabled (file.include) | Periodic log mark for rsyslog (disabled by default). |
file.include/etc/rsyslog.d/30-server.conf.disabled (file.include) | Remote server output template for rsyslog (disabled by default). |
file.include/etc/rsyslog.d/60-audit-log-service.conf.disabled (file.include) | Audit log forwarding configuration for rsyslog (disabled by default). |
file.include/etc/systemd/journald.conf.d/10-minimum.conf (file.include) | Sets minimum systemd journal configuration for a small footprint. |
file.include/etc/systemd/journald.conf.d/20-rsyslog.conf (file.include) | Configures rsyslog as a consumer of the systemd journal. |
Related features
This feature has no include or exclude relationships.