New to Claude Skills? Learn how to install them →

Get Claude Skills
mukul975 on GitHub

Syslog Centralization with Rsyslog

Free

Securely centralize logs using rsyslog with TLS encryption.

by mukul97527.6k stars on mukul975/anthropic-cybersecurity-skills
2 views
Updated Aug 8, 2026
Get this skill

Free · Opens the source repo

What Syslog Centralization with Rsyslog does

This skill enables the configuration of rsyslog for centralized log collection, emphasizing security through TLS encryption. It is designed for users who need to establish a reliable and secure logging infrastructure. By generating both server and client configuration files, this skill supports the creation of a robust syslog pipeline that meets compliance and security requirements.

The process begins with the installation of necessary dependencies, followed by generating TLS certificates for both the rsyslog server and clients. The skill facilitates the creation of configurations that include a TLS listener on the server side and reliable log forwarding on the client side. Users can deploy these configurations via SSH, ensuring that log data is transmitted securely and efficiently.

This skill is particularly useful for security operations teams looking to enhance their log management practices. It aids in hardening rsyslog configurations for high availability and assists in troubleshooting TLS-based syslog forwarding. With built-in support for per-host log segregation and reliable queue settings, users can ensure that their logging infrastructure is both secure and efficient.

Ideal for environments where log centralization is critical, this skill provides a comprehensive solution for deploying and managing rsyslog in a secure manner. It streamlines the setup process while ensuring compliance with security standards, making it a valuable tool for any security-focused organization.

When to use it

Use this skill when deploying or configuring rsyslog for centralized log collection in environments requiring security controls and compliance.

When not to use it

This skill may not be suitable for environments that do not require TLS encryption or centralized log management.

What you can build with it

Deploying a Centralized Logging System

Use this skill to set up a secure, centralized logging system in your organization, ensuring compliance with security standards.

Enhancing Log Management Practices

Implement this skill to improve existing log management practices by centralizing logs and securing them with TLS.

Testing Security Configurations

Utilize this skill in a lab environment to test and validate rsyslog configurations before deploying them in production.

How to install Syslog Centralization with Rsyslog

View source

1. Install with the skills CLI

npx skills add mukul975/anthropic-cybersecurity-skills/implementing-syslog-centralization-with-rsyslog --agent claude-code

2. Or install it manually

Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.

Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs

Inside SKILL.md

Written by mukul975

Implementing Syslog Centralization with Rsyslog

When to Use

  • When deploying or configuring implementing syslog centralization with rsyslog capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Familiarity with security operations concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install jinja2 paramiko
  2. Generate TLS certificates for rsyslog server and clients using OpenSSL.
  3. Run the agent to generate rsyslog server and client configurations:
    • Server: TLS listener on port 6514, per-host directory output, JSON-format templates
    • Client: TLS forwarding with disk-assisted queues for reliability
  4. Deploy configurations to servers via SSH (paramiko).
  5. Validate TLS connectivity and log delivery.
python scripts/agent.py --server-ip 10.0.0.1 --clients 10.0.0.10,10.0.0.11 --ca-cert ca.pem --output syslog_report.json

Examples

Server Configuration (TLS)

module(load="imtcp" StreamDriver.Name="gtls" StreamDriver.Mode="1"
       StreamDriver.Authmode="x509/name")
input(type="imtcp" port="6514")
template(name="PerHostLog" type="string" string="/var/log/remote/%HOSTNAME%/%PROGRAMNAME%.log")
*.* ?PerHostLog

Client Configuration (Reliable Forwarding)

action(type="omfwd" target="10.0.0.1" port="6514" protocol="tcp"
       StreamDriver="gtls" StreamDriverMode="1"
       StreamDriverAuthMode="x509/name"
       queue.type="LinkedList" queue.filename="fwdRule1"
       queue.maxdiskspace="1g" queue.saveonshutdown="on"
       action.resumeRetryCount="-1")

Frequently asked questions about Syslog Centralization with Rsyslog

Similar skills

Asset Criticality Scoring for Vulns

Prioritize vulnerabilities based on asset criticality.

Performing Alert Triage with Elastic SIEM

Streamline alert triage processes in Elastic Security.

Active Directory Vulnerability Assessment

Secure your Active Directory with comprehensive assessments.

Active Directory Investigation

Streamline your Active Directory compromise investigations.

Parsing Artifacts with Eric Zimmerman Tools

Efficiently parse Windows forensic artifacts for analysis.

Operationalizing MISP Threat Feeds

Enhance threat detection with curated MISP feeds.