Yet another LogVM configuration

Community Guides
1

Introduction

Similar topic:

My solution: Using “rsyslog” + qubes tcp rpc.

Dom0

Create the RPC policy

/etc/qubes/policy.d/50-syslog.policy

qubes.ConnectTCPLog  +514          YOUR_VMS_SENDING_LOGS                          @default           allow target=sys-log

In the VM sending logs

Create the rpc script + launch it to bind the tcp port 514

/rw/config/rc.local

/usr/bin/sed 's/ConnectTCP/ConnectTCPLog/g' /usr/bin/qvm-connect-tcp > /usr/bin/qvm-connect-tcp-log
/usr/bin/chmod +x /usr/bin/qvm-connect-tcp-log
/usr/bin/qvm-connect-tcp-log 514:@default:514

configure rsyslog

/etc/rsyslog.d/remote.conf

if ($syslogseverity <= 4 or 
    $programname contains 'EXAMPLE_FILTER_STRING') then {
    action(type="omfwd" target="127.0.0.1" port="514" protocol="tcp")
}

configure persistence for the rsyslog configuration

/rw/config/qubes-bind-dirs.d/50-user.conf

binds+=( '/etc/rsyslog.d/' )

sys-log

configure persistance

/rw/config/qubes-bind-dirs.d/50-user.conf

binds+=( '/etc/rsyslog.d/' )
binds+=( '/var/log/qubes/' )

configure rsyslog

/etc/rsyslog.d/remote.conf

template(name="PerVmFile" type="string" string="/var/log/qubes/remote/%programname:13:999%.%$YEAR%-%$MONTH%-%$DAY%.log")
template(name="QubesLogFormat" type="string" string="%timegenerated%: %msg%\n")
if ($programname startswith "remote-qube-") then {
    action(type="omfile" dynaFile="PerVmFile" template="QubesLogFormat")
    stop
}

Configure ConnectTCPLog script

/rw/config/rc.local

#!/bin/sh

echo '#!/bin/bash
exec logger -t "remote-qube-$QREXEC_REMOTE_DOMAIN"
' | tee /etc/qubes-rpc/qubes.ConnectTCPLog
chmod +x /etc/qubes-rpc/qubes.ConnectTCPLog
/usr/sbin/systemctl enable rsyslog
/usr/sbin/systemctl start rsyslog
2 Likes
2

Thank you for this guide. This will be quite useful for enterprise deployments.