Acquis.yaml and journald

1

Hello mates

When I use the acquis.yaml with journald I used to send each specific services like the documentation states

but with NethServer we cannot really know what we host on the server, I find an easy way (lazzy way) to push to crowdsec everything that I need

---
source: journalctl
journalctl_filter:
  - "_TRANSPORT=journal"
labels:
  type: syslog
---
source: journalctl
journalctl_filter:
  - "_TRANSPORT=syslog"
labels:
  type: syslog
---
source: journalctl
journalctl_filter:
  - "_TRANSPORT=stdout"
labels:
  type: syslog
---

I think that we could push also for the kernel that you could need if you want the iptables collection

looks for : _TRANSPORT=
https://www.man7.org/linux/man-pages/man7/systemd.journal-fields.7.html

Do you think I could make a PR to the documentation ?

2

Yes I believe this should be added to the documentation but it should just inform you can use any journalctl arguments rather than listing them and probably reference the manpage.

1 Like