Linux Syslog - Atatus Docs

Overview

Most estates already forward syslog from every Linux host to a central collector. Atatus reads those collected files and turns them into security events: SSH brute force, invalid-user enumeration, root logins, sudo misuse, user and group changes, SELinux/AppArmor denials, kernel module loads, and package changes. You install the agent on the collector only. The machines forwarding to it need nothing.

Syslog lines are translated into the same fields the Linux Audit Log integration produces, so both feeds are covered by the same detection rules. A host that ships syslog gets the same detections as one running auditd.

Requirements

Component	Requirement
Agent	`atatus-infra-agent`
Version	4.3.0+
Runs on	The central syslog collector only
Collector	rsyslog or syslog-ng receiving remote syslog

Step 1: Receive syslog on the collector

Create /etc/rsyslog.d/10-atatus-central.conf:

module(load="imtcp")
module(load="imudp")

# Timestamp with timezone + hostname, both required, see the note below
template(name="AtatusLine" type="string"
         string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n")

ruleset(name="atatus") {
    action(type="omfile" file="/var/log/central/syslog.log"
           template="AtatusLine" fileCreateMode="0640")
}

input(type="imtcp" port="514" ruleset="atatus")
input(type="imudp" port="514" ruleset="atatus")

sudo systemctl restart rsyslog

The date-rfc3339 timestamp and %HOSTNAME% are not optional.Traditional syslog format (Mar 6 08:00:00) carries no year and no timezone. Atatus will not guess either, so events are stamped with the time the agent read them instead of when they happened, which makes one incident appear hours apart across hosts.Without %HOSTNAME% every event looks like it came from the collector, and per-host detection thresholds stop working.

On every other machine

Add to /etc/rsyslog.conf, replacing the IP with your collector:

*.*  @@10.0.0.5:514

sudo systemctl restart rsyslog

syslog-ng equivalent

source s_remote { network(transport("tcp") port(514)); };

destination d_atatus {
    file("/var/log/central/syslog.log"
         template("${ISODATE} ${HOST} ${MSGHDR}${MSG}\n")
         create-dirs(yes) dir-perm(0750) perm(0640));
};

log { source(s_remote); destination(d_atatus); };

Step 2: Configure log rotation

This is what stops old logs being sent. The agent reads a file it has not seen before from the beginning, so whatever is sitting in the file when the agent first starts gets collected.

How often you rotate is the most history that can ever be sent. Rotate daily and the first read covers at most one day; rotate hourly and at most one hour.

Create /etc/logrotate.d/atatus-central:

/var/log/central/syslog.log {
    daily
    rotate 14
    missingok
    notifempty
    compress
    delaycompress
    create 0640 syslog adm
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

After rotation the old file is renamed and a new empty file takes its place, so there is never old content for the agent to re-read.

Do not use copytruncate. It empties the same file instead of replacing it, and the agent re-sends the whole file on every rotation.Keep the postrotate block. Without it rsyslog keeps writing to the old renamed file and the new one stays empty. This is silent, and it looks like the agent stopped working.

Verify the configuration:

sudo logrotate -d /etc/logrotate.d/atatus-central

Step 3: Rotate once before enabling collection

Your file already holds days or weeks of old logs. The agent has not read it yet (it only starts once you add the configuration in Step 4), so rotating now means it opens a nearly empty file.

sudo logrotate -f /etc/logrotate.d/atatus-central
ls -la /var/log/central/

syslog.log should now be small, with the previous content moved aside as syslog.log.1. The agent never reads rotated files. Skip this step and the agent collects everything currently in the file on its first run, up to one full rotation period of history.

Step 4: Configure the agent

Create /etc/atatus-infra-agent/conf.d/files.d/syslog.yml:

logs:
  - type: file
    source: linux.syslog
    service: syslog
    paths:
      - /var/log/central/syslog.log
    exclude_lines:
      - 'avahi-daemon'
      - 'dbus-daemon'
      - 'systemd-resolved'

source: linux.syslog and service: syslog must be exactly these values. They are what route the events to SIEM instead of ordinary Logs. Any other pair ships the data as application logs with no detections attached.

Point paths at the live file only. Do not add syslog.log.* or a wildcard, as that makes the agent read the rotated copies too and send everything again. exclude_lines drops noisy chatter before it is indexed or billed. Add your own patterns as needed.

Step 5: Restart and verify

sudo service atatus-infra-agent restart

Send a test event from any forwarding machine:

logger -p auth.notice "atatus test event"

Then open SIEM → Security Events in Atatus and filter on dataSource: linux_syslog.

Send to Logs instead of SIEM

By default these lines become security events. To keep them as ordinary searchable logs instead, add siem: false:

logs:
  - type: file
    source: linux.syslog
    service: syslog
    siem: false
    paths:
      - /var/log/central/syslog.log

What gets detected

Recognised programs are translated into the same fields as the Linux Audit Log integration:

Source	Detections
`sshd`	SSH brute force, invalid-user enumeration, root login over SSH, successful login after repeated failures
`sudo`	Sudo authentication failure bursts, commands run as root, `NOT in sudoers` denials
`su`	Failed and successful privilege escalation
`useradd` / `userdel` / `usermod` / `groupadd`	Account creation and deletion, privileged group membership changes
`passwd`	Password changes, including root
`kernel`	SELinux and AppArmor denials, kernel module loads
`systemd`	Service starts and stops, including logging and audit services
`auditd`	Audit daemon stopped or reconfigured
Package managers	Installs and removals, including of security tooling

Lines from programs that are not recognised are still stored and searchable. They simply do not contribute to detection thresholds.

Troubleshooting

Symptom	Likely cause	Fix
Events arrive but no detections fire	`source`/`service` are not the exact pair	Set `linux.syslog` / `syslog` and restart
Every event timestamped at install time	Collector writing traditional syslog format	Use the `date-rfc3339` template from Step 1
All events attributed to the collector	Template is missing `%HOSTNAME%`	Add it, because per-host rules depend on it
Duplicate events after each rotation	`copytruncate` in logrotate	Remove it; use `create`
Old events re-sent after every restart	Agent data directory not writable	Check ownership of `/var/lib/atatus-infra-agent/`
A new file is never read	Files under 1 KB cannot be tracked yet	Expected, it is picked up once it grows

What to expect on day one. The agent reads the current file from its start, so up to one rotation period of history arrives at once. Those events keep their original timestamps, which means they land in time windows the detection engine has already evaluated. They are searchable in the UI, and correctly silent for alerting.

​Overview

​Requirements

​Step 1: Receive syslog on the collector

​On every other machine

​syslog-ng equivalent

​Step 2: Configure log rotation

​Step 3: Rotate once before enabling collection

​Step 4: Configure the agent

​Step 5: Restart and verify

​Send to Logs instead of SIEM

​What gets detected

​Troubleshooting

Overview

Requirements

Step 1: Receive syslog on the collector

On every other machine

syslog-ng equivalent

Step 2: Configure log rotation

Step 3: Rotate once before enabling collection

Step 4: Configure the agent

Step 5: Restart and verify

Send to Logs instead of SIEM

What gets detected

Troubleshooting