SIEMs in Bits and Pieces

Configuring rsyslog to split the logs by device IP and rotate the logs on daily basis The following steps apply to a new installation of Ubuntu 16, with the default rsyslog settings 1. Modify the rsyslog configuration file, /etc/rsyslog.conf and uncomment the settings for the UDP listener: # provides UDP syslog reception module(load="imudp") input(type="imudp" port="514") This will instruct rsyslog to listen on UDP/514 for syslog messages. Adjust these according for other ports or if TCP is needed (see the # provides TCP syslog reception) setting. At the end of the file, after the line: $IncludeConfig /etc/rsyslog.d/*.conf Add: $template DailyPerHost,"/var/log/syslog_devices/%HOSTNAME%/%HOSTNAME%-%$YEAR%-%$MONTH%-%$DAY%.log" *.* -?DailyPerHost These settings will create individual logs for each logging device under the /var/log/syslog_devices folder. The logs will be rotated on daily basis. For example, a device with hostname

Useful answers for common Ubuntu questions There are quite a few questions that come up (at least for me) every time I install a new Ubuntu server. Unless you are a "Linux guy", you tend to forget how a specific task was done. Here are some of them: Question: When using a terminal window in a Linux graphical interface you may find out that the familiar "tab" used to auto-complete a command is now switching to the next open application, like in Windows. So, how to enable auto-complete in Ubuntu graphical interface terminal? Answer: Open Application Menu > Settings > Window Manager. Click on Keyboard tab. Clear the Switch window for same application setting. Source: https://askubuntu.com/questions/545540/terminal-autocomplete-doesnt-work-properly/545578 Also, the Ctrl-Alt-D shortcut can be used to "show the desktop". Question: How do you verify and install the latest updates in Ubuntu? Answer : In a terminal enter the following c