Skip to content

Migration documentation: syslog input alternative - #36781

Merged
Nicogp merged 7 commits into
mainfrom
docs/36568-syslog-input-alternative
Jun 8, 2026
Merged

Nicogp merged 7 commits into
mainfrom
docs/36568-syslog-input-alternative

Conversation

@rovogel

@rovogel rovogel commented Jun 8, 2026

Copy link
Copy Markdown
Member

Description

Documents the migration path for users who relied on the Wazuh 4.x syslog input on port 514 (<connection>syslog</connection> in remoted), which was removed in Wazuh 5.0. The guide covers setting up rsyslog as the syslog receiver and a Wazuh agent as the log forwarder, with two alternative pipelines.

Closes #36568

Proposed Changes

New guide: docs/guide/migration/syslog-input-4x-to-5x.md. It covers:

  • What changed in 5.0: remoted no longer accepts syslog on port 514; an rsyslog daemon and a Wazuh agent are now required on the collection host.
  • Agent installation note: the Wazuh agent is not bundled with the manager in 5.0 and must be installed separately, even on the manager host.
  • Two migration options:
    • Option A — rsyslog → systemd journal (omjournal) → logcollector (journald reader, enabled by default). Includes a note on the required %HOSTNAME% %syslogtag%%msg% message template to preserve the sender's hostname in journal entries, which would otherwise be lost.
    • Option B — rsyslog → per-host log files → logcollector (<localfile> stanza). Includes log rotation configuration.
  • Configuration mapping table: maps every 4.x <remote> config element to its 5.x rsyslog/agent equivalent.
  • Decoder and rule compatibility: existing decoders (e.g. cisco-asa, pf, juniper) require no changes.
  • Migration example: end-to-end walkthrough using a Cisco ASA firewall as the syslog source, with both options demonstrated side by side as collapsible sections.

Results and Evidence

Option A validated on Ubuntu 24.04:

  • rsyslog with omjournal + %HOSTNAME% %syslogtag%%msg% template confirmed to write sender hostname into journal entries.
  • Without the template, all journal entries appear under the local machine's hostname — this limitation is documented in the guide.

Artifacts Affected

N/A

Configuration Changes

N/A — the guide documents external rsyslog configuration and Wazuh agent ossec.conf changes, not any default configuration shipped with Wazuh.

Documentation Updates

  • Added docs/guide/migration/syslog-input-4x-to-5x.md
  • Updated docs/SUMMARY.md with a link to the new guide

Tests Introduced

N/A

Review Checklist

  • Code changes reviewed
  • Relevant evidence provided
  • Tests cover the new functionality
  • Configuration changes documented
  • Developer documentation reflects the changes
  • Meets requirements and/or definition of done
  • No unresolved dependencies with other issues

@rovogel
rovogel requested a review from Copilot June 8, 2026 13:49
@rovogel rovogel linked an issue Jun 8, 2026 that may be closed by this pull request
7 tasks
@rovogel rovogel changed the title Docs/36568 syslog input alternative Migration documentation: syslog input alternative Jun 8, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new migration guide documenting how to replace the removed Wazuh 4.x remoted syslog listener (port 514) in Wazuh 5.x using rsyslog plus a Wazuh agent (logcollector).

Changes:

  • Introduces a new migration guide describing two ingestion pipelines: rsyslog → journald (omjournal) and rsyslog → per-host log files.
  • Provides configuration mapping from 4.x <remote> settings to 5.x rsyslog/agent equivalents, plus an end-to-end example.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
@rovogel
rovogel force-pushed the docs/36568-syslog-input-alternative branch from fea2632 to a2ecdc4 Compare June 8, 2026 19:40
@rovogel
rovogel requested review from Nicogp and Copilot June 8, 2026 20:21

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 7 changed files in this pull request and generated 7 comments.

Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 7 changed files in this pull request and generated 7 comments.

Comment thread docs/SUMMARY.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md
Comment thread docs/guide/migration/syslog-input-4x-to-5x.md Outdated
Nicogp
Nicogp previously approved these changes Jun 8, 2026
@Nicogp
Nicogp merged commit 3117deb into main Jun 8, 2026
1 check passed
@Nicogp
Nicogp deleted the docs/36568-syslog-input-alternative branch June 8, 2026 21:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Document Syslog Input alternative in 5.0

3 participants