syslog สุดโหด เหมือนโกรธใครมา?

syslog > ~ sudo apt install -y rsyslog-gnutls
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libflashrom1 libftdi1-2
Use 'sudo apt autoremove' to remove them.
Suggested packages:
  gnutls-bin
[... truncated output ...]

syslog > ~ sudo vi /etc/rsyslog.conf

#-  เพิ่มข้อมูลส่วนนี้ใน configuration

module(load="imtcp"
    StreamDriver.Name="gtls"
    StreamDriver.Mode="1" # run driver in TLS-only mode
    StreamDriver.Authmode="x509/name"
    PermittedPeer="docker.d8k.io"
)
input(type="imtcp" port="514")
global(
    DefaultNetstreamDriver="gtls"
    DefaultNetstreamDriverCAFile="/etc/pki/rsyslog/ca.crt"
    DefaultNetstreamDriverCertFile="/etc/pki/rsyslog/server1.crt"
    DefaultNetstreamDriverKeyFile="/etc/pki/rsyslog/server1.key"
)

syslog ~  >  cat <<-EOF | sudo tee /etc/rsyslog.d/01-container-log.conf 
\$template containerLogs,"/var/log/docker/%hostname%_%syslogtag:R,ERE,1,ZERO:.*cname/([^\[]+)--end%.log"

if \$syslogtag contains 'cname'  then -?containerLogs

& stop
EOF

syslog > ~ sudo systemctl restart rsyslog

syslog > ~ ss -tlanp | grep 514
LISTEN 0      25            0.0.0.0:514          0.0.0.0:*
LISTEN 0      25               [::]:514             [::]:*

docker > ~ cat /etc/docker/daemon.json
{
   "log-driver": "syslog",
      "log-opts": {
           "syslog-address": "tcp+tls://syslog.d8k.io:514",
           "tag": "cname/\{\{.Name\}\}",
           "syslog-tls-ca-cert": "/etc/docker/ca.crt",
           "syslog-tls-cert": "/etc/docker/client1.crt",
           "syslog-tls-key": "/etc/docker/client1.key"
      }
}
# เพิ่มเติมข้อมูลส่วน log driver ในไฟล์

docker > ~ sudo systemctl restart docker

[at Docker Host]
docker > ~ docker container run -d --name mynginx --rm nginx
68d9f69002be79e0125a6ad3b3d4cf1b94ff7aa787a2973412e834a7c1bb1542


[at Syslog Server]
syslog > ~ sudo ls -la /var/log/docker
total 16
drwxr-xr-x 2 syslog syslog 4096 Jan  6 14:44 .
drwxrwxr-x 9 root   syslog 4096 Jan  6 14:44 ..
-rw-r----- 1 syslog adm    4873 Jan  6 14:49 128.199.210.227_mynginx.log

syslog > ~ sudo tail -n 3 /var/log/docker/128.199.210.227_mynginx.log
Jan  6 14:49:57 128.199.210.227 cname/mynginx[3660]: 2023/01/06 14:49:57 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
Jan  6 14:49:57 128.199.210.227 cname/mynginx[3660]: 2023/01/06 14:49:57 [notice] 1#1: start worker processes
Jan  6 14:49:57 128.199.210.227 cname/mynginx[3660]: 2023/01/06 14:49:57 [notice] 1#1: start worker process 29

[at client (docker.d8k.io)]
docker > ~ logger --tcp --server syslog.d8k.io --port 514 "Hello Syslog Server"

[at syslog server]
syslog > ~ sudo tail -f /var/log/syslog
[... truncated output ...]
Jan  6 14:54:29 syslog rsyslogd: gnutls returned error on handshake: An unexpected TLS packet was received.  [v8.2112.0 try https://www.rsyslog.com/e/2083 ]
Jan  6 14:54:29 syslog rsyslogd: tcpsrv listener (inputname: 'imtcp') failed to process incoming connection with error -2083 [v8.2112.0 try https://www.rsyslog.com/e/2083 ]

syslog > ~ sudo tail -f /var/log/syslog
[... truncated output ...]
Jan  6 15:09:45 syslog rsyslogd: error: peer name not authorized -  not permitted to talk to it. Names: CN: docker;  [v8.2112.0 try https://www.rsyslog.com/e/2088 ]
Jan  6 15:09:45 syslog rsyslogd: netstream session 0x7f67e000d640 from 128.199.210.227 will be closed due to error [v8.2112.0 try https://www.rsyslog.com/e/2089 ]

syslog > ~ sudo tail -f /var/log/syslog
[... truncated output ...]
Jan  6 15:14:59 syslog rsyslogd: error: peer name not authorized -  not permitted to talk to it. Names: DNSname: docker.d8k.io; CN: docker;  [v8.2112.0 try https://www.rsyslog.com/e/2088 ]
Jan  6 15:14:59 syslog rsyslogd: netstream session 0x7f2f9401bef0 from 128.199.210.227 will be closed due to error [v8.2112.0 try https://www.rsyslog.com/e/2089 ]