Q&A Is there a way to authenticate syslog sources?

[ohemelaar]

Question

I'm trying to use vector to get logs from a PaaS in my own collector. Being on different networks, I figured I needed TLS and auth. TLS seems okay, but I don't see options for auth in the syslog source.

The PaaS I use provides an option for a token in their syslog drain config: https://doc.scalingo.com/platform/app/log-drain#syslog-tcptls

Is it possible at all to authenticate logs coming to vector?

Vector Config

No response

Vector Logs

No response

[jszwedko]

Hey! The only option that Vector supports for syslog authentication is mTLS (i.e. client certificates that the server will validate) via tls.ca_crt.

I see in your link that Scalingo supports setting a token. I'm curious how that is passed by clients 🤔 Do you know?

[ohemelaar]

I got an answer from their support team. The token is sent as a prefix in the syslog message. They recommend using TLS without validating the client cert, and adding a transform to drop logs where the token doesn't match.