SysLog

info

Per default, the features described here are not shipped along with Orchestra Business Suite.
Please contact our Support to retrieve any required modules.

Orchestra has built-in support for connecting to a SysLog server over network connections as well as providing its own SysLog server for remote clients.

The following chapter describes how to configure the SysLog client and server in Orchestra Runtime.

Prerequisites

Since the SysLog implementation is designed as a Component, ensure to configure loading of Extended Java Components first. Afterwards, copy the following Java archives to a subfolder (e.g. syslog) of your libext directory.

Java archive	Condition
orchestra-syslog-component-client-<version>.jar	You like to use the SysLog client within Orchestra.
orchestra-syslog-component-server-<version>.jar	You want Orchestra to provide a SysLog server.
orchestra-syslog-example-processor-<version>.jar	You like to store SysLog messages received by your server in the Orchestra database.

Once done, restart your Orchestra application to make sure the Component loader picks up the newly added modules.

Configuration

The configuration is done using Orchestra Component Browser.

SysLog Client

The Orchestra SysLog client is capable of sending SysLog messages over the network to a SysLog server.

Configuration

info

Make sure you have already deployed the required orchestra-syslog-component-client artifact to your Orchestra environment.

The configuration consists of two steps:

1. Define at least one target connection.
2. Configure log events in your process model to send messages over these connections.

In case you want to connect to the SysLog server using TLS, another step is required for key and certificate exchange.

Define a connection

Open the SyslogClient section in your Component Browser. If not present already, create a new group for your connection under the root SyslogClient configuration. You will see the following configuration parameters per connection:

Parameter	Type / Possible Values	Description
Connection identifier	Any unique String	Identifies the current connection to allow referring to it later.
is active	boolean: yes | no	Flag if the current connection may be used in process models or not. Per default, the example syslog connection is not active! Make sure to enable it first.
Server host	Host name or IP address	Host name or IP address of the target SysLog server, e.g. 127.0.0.1 or my-syslog-host.mycompany.local.
Server port	Integer describing a network port	Port used to connect to the SysLog server. For TCP connections, usually it is 514. For TLS-secured connections, usually it is 6514.
Connection protocol	Choice between tcp | udp | tls	Defines which transport protocol is used to connect to the server.
is persistent	boolean: yes | no	When enabled, Orchestra keeps TCP and TLS connections open after sending a message to the server. This reduces the overhead of establishing new TCP connections per log message. Default: yes.

Example: Configure connection over unencrypted TCP connection

Parameter	Value
Connection identifier	mySyslogServerOverTcp
is active	yes
Server host	localhost
Server port	514
Connection protocol	tcp
is persistent	yes

Example: Configure connection over encrypted TLS connection

Parameter	Value
Connection identifier	mySyslogServerOverTls
is active	yes
Server host	syslog.mycompany.local
Server port	6514
Connection protocol	tls
is persistent	yes

Make sure to read the TLS section below to configure certificates and private keys properly.

Configure Log events

Once you created and activated a connection you are able to select it as target in intermediate log events in Orchestra process models.

Refer to Log event chapter in Designer Manual for details.

Configure TLS

Since client authentication of SysLog senders is mandatory according to RFC 5425 a TLS connection requires both: The server-side TLS certificate to identify the server on client side and a client-side keypair and certificate to identify the client on server side.

Server side TLS certificate

The signing authority of your server's certificate must be stored in your JREs keystore. Therefore, Java provides the key tool which allows you to do this by using a single command.

Add certificate authority to JRE certificate store
# keytool -import -alias "Root CA (SysLog)" -file /path/to/your/ca/cert.pem -keystore /path/to/your/jre/lib/security/cacerts

You will be asked for the keystore password of cacerts first (default: changeit) before you are displayed the certificate details to confirm them.

Client certificate authentication

For client side authentication you need to create a new Java Keystore (which contains exactly one key) in your Orchestra configuration directory.

Path	config/security/syslog.keystore
Keystore Password	ORCHESTRA
Key Password	ORCHESTRA

Do not forget to let the server accept the certificate provided by this configuration.