topic Re: Is it possible to manage syslog-ng.conf using a deployment server? in Getting Data In

Is it possible to manage syslog-ng.conf using a deployment server?

cburgman — Wed, 14 Sep 2016 14:57:24 GMT

I am currently managing 4 syslog servers using syslog-ng. I am trying to figure out the best way to manage the syslog-ng.conf file to prevent myself from having to make the same changes in 4 different locations.

Re: Is it possible to manage syslog-ng.conf using a deployment server?

czanik — Wed, 14 Sep 2016 15:44:58 GMT

For example using puppet. There are many modules, this one was published by a former syslog-ng upstream developer and manages tens of thousands of machines: https://forge.puppet.com/ihrwein/syslog_ng

Re: Is it possible to manage syslog-ng.conf using a deployment server?

cburgman — Wed, 05 Oct 2016 20:32:35 GMT

Thanks for the info. Was hoping there was a way to do it painlessly with the deployment server. I will look into either puppet or ansible.

Re: Is it possible to manage syslog-ng.conf using a deployment server?

rpquinlan — Wed, 11 Apr 2018 18:34:16 GMT

I was thinking about this today.. I wonder if this would work using the deployment server?

On the deployment server, /etc/deployment-apps, create a folder syslogng_config with subfolders metadata and local, just like you would for a real Splunk app.
Add another subfolder called "config" or something that Splunk doesn't use. Inside it, add your syslog-ng config file variables in a file, and reference the path in the 'real' syslog-ng.conf file. Ref: https://syslog-ng.com/documents/html/syslog-ng-ose-3.14-guides/en/syslog-ng-ose-guide-admin/html/including-config-files.html
On your deployment server "Forwarder management", add your new app as normal.

As long as the file/folder permissions are good between Splunk and Syslog-NG, I would think this will work..

Re: Is it possible to manage syslog-ng.conf using a deployment server?

rpquinlan — Wed, 11 Apr 2018 20:13:54 GMT

It worked!!

At the very top of the syslog-ng.conf file, I added a statement:

@include "/opt/splunkforwarder/etc/apps/syslogng_config/*.conf"

Likely because I'm editing the file in Windows and deploying to linux, there were some syntax errors with missing spaces - identified with the command

syslog-ng --syntax-only
The output from that shows that there was a syntax error, but also where it pulled it from (my deployment server path)

After that, reloading the syslog-ng config made the new, managed config go live.

Hope this helps!