rsyslog (logging)

The SC//Reliant™ platform uses rsyslog, an open-source utility, to collect, process, filter, and forward system and application log messages. The platform's rsyslog implementation can be configured to act as a log concentrator, a log storage location, a log forwarder, or any combination of the three.

Typical configuration

A common deployment pattern has the SC//Reliant edge device act as a log concentrator for on-premises devices before forwarding the logs to a concentrator in the SC//Reliant Management Plane. The Management Plane concentrator then collects all logs before forwarding them to the operator's chosen downstream destination.

The platform is logging-destination-agnostic. Any syslog-compatible SIEM, log analytics platform, or object store can be the downstream target; common examples include Elasticsearch, Splunk, Datadog, New Relic, Sumo Logic, IBM QRadar, Microsoft Sentinel, an operator-managed Kafka pipeline, or cloud-native log services such as Amazon CloudWatch Logs, Azure Monitor Logs, and Google Cloud Logging. These are named only as illustrative examples. Scale Computing does not require operators to standardize on any specific logging vendor or cloud provider.

Role in the platform

rsyslog is the data pipeline for both operational logs and security telemetry. System and application logs from every edge node flow through rsyslog into the central log store, where they feed:

• The operator's chosen Security Information and Event Management (SIEM) platform for security monitoring and threat detection; the platform is SIEM-agnostic and integrates with any syslog-capable SIEM.
• Compliance reporting (PCI DSS audit trails, change records, access logs).
• Operational analytics and incident investigation in the operator's chosen observability stack.

Edge-node and management-plane events are forwarded in near real time, so an actor on a source system cannot retroactively alter logs that have already been centralized.

Related documentation

• Managing logs: the platform logging documentation, including filter syntax and SIEM integration.
• Monitoring your environment: how log-stream events feed the monitoring and remediation pipeline.