Linux Syslog Integration

Overview

This integration collects SSH authentication, sudo usage, user management, cron jobs, and system event logs from Linux servers using the built-in rsyslog service. No additional agent is required.

Supported OS: CentOS, Rocky Linux, Ubuntu, Debian

---

Prerequisites

• A KYRA MDR Collector installed and running (Installation Guide)
• Root or sudo access on the Linux server
• Network connectivity from the server to the collector on port 514

---

Configuration

Step 1: Configure rsyslog

Add the following line to /etc/rsyslog.conf or create a file in /etc/rsyslog.d/:

# TCP (recommended for reliable delivery)
*.* @@KYRA_COLLECTOR_IP:514

# UDP (alternative)
*.* @KYRA_COLLECTOR_IP:514

Restart rsyslog:

sudo systemctl restart rsyslog

Step 2: Enable auditd (Optional, Recommended)

For detailed file access and command execution auditing, configure auditd:

/etc/audit/audit.rules

-w /etc/passwd -p wa -k user_changes
-w /etc/shadow -p wa -k password_changes
-a always,exit -F arch=b64 -S execve -k command_execution

Forward audit logs via audisp-remote to the KYRA Collector.

Step 3: Verify Logs

# Check syslog is sending
sudo tcpdump -i any port 514 -c 5

# Check collector is receiving
sudo journalctl -u kyra-collector --since "5 minutes ago"

---

Collected Log Types

Log Type	Source File	Security Use	Priority
SSH login	/var/log/auth.log	Brute force, unauthorized access	Critical
sudo usage	/var/log/auth.log	Privilege escalation detection	High
User management	/var/log/auth.log	Backdoor account creation	Critical
cron execution	/var/log/cron	Malicious scheduled tasks (persistence)	High
Service start/stop	systemd journal	Service tampering detection	Medium
Firewall logs	/var/log/messages	iptables/firewalld block events	Medium
auditd	/var/log/audit/audit.log	File access, process execution	High

---

Troubleshooting

No Logs Received

1. Verify rsyslog is running: systemctl status rsyslog
2. Check that the collector IP is correct in the rsyslog configuration
3. Ensure no firewall rules block port 514

Missing Auth Logs

• On Ubuntu/Debian, auth logs are in /var/log/auth.log
• On CentOS/RHEL, auth logs are in /var/log/secure
• Ensure rsyslog is configured to forward auth.* facility

For additional help, contact kyra@seekerslab.com.