# /etc/rsyslog.d/10-remote.conf on the syslog relay host.
#
# Wazuh 5.0 removed the manager's syslog listener. Network devices that cannot
# run an agent send to an rsyslog relay, and a Wazuh agent on that relay reads
# the file rsyslog writes.
#
# The message template must start with an RFC3164 timestamp. Without it the
# standard syslog decoders do not match and the events land in
# wazuh-events-v5-unclassified-* with only event.original populated.
#
# References:
# https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/log-data-collection/use-cases.html
# https://github.com/wazuh/wazuh/blob/main/docs/guide/migration/syslog-input-4x-to-5x.md

module(load="imudp")
module(load="imtcp")

template(name="TraditionalSyslogFormat" type="string"
         string="%timegenerated% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg%\n")

ruleset(name="remote") {
    action(type="omfile" file="/var/log/remote.log" template="TraditionalSyslogFormat")
    stop
}

input(type="imudp" port="514" ruleset="remote")
input(type="imtcp" port="514" ruleset="remote")

# One file per sending device instead of one shared file. Use this when you
# want to tell devices apart, because the agent reads a local file and the
# original source IP is otherwise lost. Create /var/log/remote first:
#   sudo install -d -o syslog -g adm /var/log/remote
#
# template(name="RemoteHostLogs" type="string"
#          string="/var/log/remote/%FROMHOST-IP%.log")
# ruleset(name="remote_to_file") {
#     action(type="omfile" dynaFile="RemoteHostLogs")
# }