mirror of
https://github.com/Sea-Haven-Industries/syslog-server.git
synced 2026-09-30 11:13:15 +00:00
2b12aba50e
Replace the public rsyslog-to-CloudWatch collector with Vector over a prod 10.40 IPsec VGW, Firehose, 90-day S3, Glue, and Athena.
25 lines
710 B
Text
25 lines
710 B
Text
#!/bin/bash
|
|
set -euxo pipefail
|
|
|
|
# Vector: listen on UDP/TCP 514 and IPFIX 2055/2056, parse, ship to Firehose.
|
|
curl -sSL https://setup.vector.dev | bash
|
|
dnf install -y vector
|
|
|
|
install -d -m 0755 /etc/vector /var/lib/vector
|
|
cat > /etc/vector/vector.yaml <<'VECTOREOF'
|
|
${vector_yaml}
|
|
VECTOREOF
|
|
chmod 0644 /etc/vector/vector.yaml
|
|
vector validate /etc/vector/vector.yaml
|
|
|
|
install -d -m 0755 /etc/systemd/system/vector.service.d
|
|
cat > /etc/systemd/system/vector.service.d/override.conf <<'EOF'
|
|
[Service]
|
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETUID CAP_SETGID
|
|
NoNewPrivileges=false
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now vector
|
|
systemctl restart vector
|