adstec/irf-syslog repository overview

⁠syslog-ng Log Collector for ADS-TEC IRF3000

Sample container by ADS-TEC Industrial IT: syslog-ng 4.8 (Alpine) as central syslog collector in the rootless Docker of the IRF3000 industrial firewalls, with a size-capped log archive and read-only log access over SSH.

• Receives syslog on UDP/TCP 514 (RFC 3164 and RFC 5424, detected automatically), TCP 601 (RFC 5424) and TCP 6514 (TLS, RFC 5425)
• One file per sender and hour, compressed after the hour
• Size cap and retention period, enforced by the container (Docker cannot size-limit volumes on the IRF)
• SSH on port 2222 for user logs with lnav, ripgrep and sftp - read-only, no root login, no forwarding
• Self-signed TLS certificate, SSH host keys and the generated SSH password are kept in the volume

⁠Quick start

docker run -d --name syslog --hostname syslog --restart unless-stopped \
  --network host -v syslog-data:/var/log/remote \
  -e LOG_MAX_SIZE=1G -e LOG_RETENTION_DAYS=90 -e TZ=Europe/Berlin \
  adstec/irf-syslog
docker exec syslog cat /var/log/remote/.sshd/password
ssh -p 2222 logs@<irf-address>

No --privileged, no additional capabilities.

Setup, port forwarding and sending the IRF's own event and audit log to the collector are described in the Docker Application Note of ADS-TEC Industrial IT.

⁠Links

• Source files on GitHub⁠ - Dockerfile, IRF setup script and README
• IRF3000 industrial firewall⁠ - product page of ADS-TEC Industrial IT

⁠Platforms and license

linux/arm64 (IRF3000), linux/arm/v7. syslog-ng is licensed under LGPL/GPL.