initial commit

roles/logging_rsyslog/templates/60-forward-siem.conf.j2

@@ -0,0 +1,24 @@
+# {{ ansible_managed }}
+{% if syslog_use_tls %}
+$DefaultNetstreamDriver gtls
+$DefaultNetstreamDriverCAFile /etc/pki/tls/certs/ca-bundle.crt
+$ActionSendStreamDriverMode 1
+$ActionSendStreamDriverAuthMode x509/name
+$ActionSendStreamDriverPermittedPeer {{ syslog_collector_host }}
+
+$ActionQueueType LinkedList
+$ActionQueueFileName siem_fwd_queue
+$ActionQueueMaxDiskSpace 1g
+$ActionQueueSaveOnShutdown on
+$ActionResumeRetryCount -1
+
+auth,authpriv.*;kern.*;cron.*  @@(o){{ syslog_collector_host }}:{{ syslog_collector_port }}
+{% else %}
+$ActionQueueType LinkedList
+$ActionQueueFileName siem_fwd_queue
+$ActionQueueMaxDiskSpace 1g
+$ActionQueueSaveOnShutdown on
+$ActionResumeRetryCount -1
+
+auth,authpriv.*;kern.*;cron.*  @{{ syslog_collector_host }}:{{ syslog_collector_port }}
+{% endif %}

roles/logging_rsyslog/templates/logrotate-cis.j2

@@ -0,0 +1,14 @@
+# {{ ansible_managed }}
+/var/log/messages /var/log/secure /var/log/maillog /var/log/cron /var/log/spooler {
+    weekly
+    rotate 12
+    compress
+    delaycompress
+    missingok
+    notifempty
+    create 0640 root root
+    sharedscripts
+    postrotate
+        /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1 || true
+    endscript
+}