rsyslog and journald in depth
You learn journald's structured fields and rsyslog rules, templates and reliable forwarding, and filter, split and keep logs without losing any.
Level 301 · 17 lessons · 15 practice labs
Lessons
journald
- Journal structure: fields, cursors and boot IDs
- journalctl in depth: field filters and output formats
- Persistent journals, size and vacuum
- Journal integrity: forward secure sealing
- Short task: find what changed between two boots from the journal
rsyslog
- rsyslog architecture: inputs, rules, actions
- Facilities and priorities: who writes where
- Conditional filters with RainerScript
- Templates and dynamic file names
- Reading from the journal and from files: imjournal, imfile
- Short task: split application logs into their own files
Reliable delivery
- Forwarding over TCP and RELP
- Disk-assisted queues: no loss when the link drops
- Carrying logs encrypted with TLS
- Short task: lose not a single line while the receiver restarts
Wrap-up
- A logging standard: format, time and retention policy
- Capstone: a lossless, encrypted log pipeline from branch servers to the centre
Practice labs
- Read the structured fields of a journal entry: Display an entry with all its fields and filter by unit, PID and user ID.
- Make the journal persistent and cap its size: Write a journal that vanishes on reboot to disk persistently and cap its total size and retention time.
- Find entries dropped by rate limiting: Find how many messages of a chatty service were suppressed, tune the limit for that unit and keep the rest of the system protected.
- Route one facility to its own file: Add a rule writing local3 messages to a separate file and test it with logger.
- Use a template for per-host files: On the receiver define a template that writes incoming entries to dynamic files by sending host and program name.
- Filter and parse conditionally with RainerScript: Drop health-check lines, send authentication failures to a separate file and extract the user name from the message as a field.
- Forward logs to the centre over TCP: Configure a client to send all logs to the central receiver over TCP and verify a test message arrives.
- Prevent loss during a receiver outage with a queue: Add a disk-assisted queue to the forwarding action, stop and restart the receiver and show entries produced meanwhile arrive.
- Protect log forwarding with mutual TLS: Deploy certificates to clients and receiver, set up encrypted forwarding that accepts only authorised client names and show an unauthorised one is refused.
- Verify journald entries reach rsyslog: Find by which path the journal feeds rsyslog and show a service message lands in the file.
- Forward entries as structured JSON: Send messages to the centre as JSON preserving journal fields and verify the fields parse on the receiver.
- Find the cause of duplicated and lost entries: In a setup where some entries arrive twice and some never, examine the input modules and rate limits and fix it.
- Open the receiver to known clients only: Make the central receiver accept logs from two client addresses only and show a third source is refused.
- Monitor the log pipeline's health with counters: Enable the rsyslog statistics module and read queue size and discarded message counters to identify the bottleneck.
- Build a reliable central logging setup with two clients: Build a setup collecting encrypted, queued, per-host logs from two clients with rotation and retention defined, and prove it with an outage test.
About this course
You learn journald's structured fields and rsyslog rules, templates and reliable forwarding, and filter, split and keep logs without losing any.
What you will learn
- journald
- rsyslog
- Reliable delivery
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.