Syslog to S3 via Fluentd
Last updated
Was this helpful?
Last updated
Was this helpful?
Consider using instead of Fluentd to forward logs to Panther. Fluent Bit is easier to set up and less resource intensive than Fluentd.
This guide provides a method to deliver syslog messages to S3 using Fluentd. There are two different pipeline flows: via an AWS Firehose delivery stream and directly to an AWS S3 bucket.
This guide assumes that an S3 bucket or Firehose has already been created. If you need to create either of these resources, please see the . If you have already provisioned the resources, you can adapt the guide below to fit your needs.
Follow the for the environment of the server from which you want to collect syslog messages.
You have two options when configuring Fluentd: using the Firehouse plugin or S3 plugin. Below are the configuration files for both options.
We recommend the Firehose plugin option as it is the more performant of the two, however both will deliver the logs to S3. Two different authentication types are shown in the configuration: assume role and access keys. Use the authentication type that best suits your environment.
Install the following Fluentd :
Edit the Fluentd configuration/etc/td-agent/td-agent.conf
with the below config. This allows Fluentd to listen for syslog events over udp port 5140 and output to Kinesis Firehose. Update the region
, delivery_stream_name
and role_arn
in the configuration below:
Edit the Fluentd configuration /etc/td-agent/td-agent.conf
with the below config. This will allow Fluentd to listen for syslog events over udp port 5140 and output to a S3 bucket. Update the s3_bucket
, s3_region
, aws_key_id
, and aws_sec_key
in the configuration below:
After configuring Fluentd, start it by running the below command:
Verify that Fluentd is running:
Configure rsyslog
to forward messages to the local Fluentd daemon by adding these two lines to the bottom of /etc/rsyslog.d/50-default.conf
or /etc/rsyslog.conf
in some environments:
Restart rsyslog with the below command:
After 5-10 minutes have passed, verify that syslog messages are being logged to the S3 bucket. Logs should be showing up under the syslog/
prefix within the bucket.
You can now onboard the data in the Panther UI by onboarding the S3 bucket and using the Fluentd.Syslog3164
log type.
See the on starting Fluentd in your environment if systemctl
is not available.