Managing logs

The SC//Reliant™ platform provides centralized logging across the full edge fleet. Every node generates system logs, application logs, security events (File Integrity Monitoring (FIM) events, firewall denies), transaction logs, and audit/access logs. These streams are forwarded in real time from each edge node to a central aggregator hosted in the selected cloud, from which they can be routed to the customer's chosen log destination.

Logging architecture

Transport is built on rsyslog. Each edge node forwards logs to a central aggregator in the SC//Reliant Management Plane, from which logs can be forwarded to the customer's chosen Security Information and Event Management (SIEM) platform or log destination, for example, Elastic, Splunk, Datadog, New Relic, or Sumo Logic. The SC//Reliant platform is agnostic to the downstream destination. Analysis, correlation, retention, and search behavior are properties of the destination platform the customer selects. At the rsyslog layer, Role-Based Access Control (RBAC) on the central aggregator restricts access by role and group, and retention is configurable per log type to match site, regional, or regulatory retention policy.

Export formats include native syslog, JSON over HTTP, and customer-defined exports through container-based forwarders for any existing tooling.

The SC//Reliant platform exposes the rsyslog transport through two complementary Puppet profiles:

• Rsyslog client (profiles::rsyslog_client) configures a node to forward log messages to one or more destination servers, including Rsyslog servers, Elasticsearch, Datadog, or New Relic. The client profile does not store logs locally.
• Rsyslog server (profiles::rsyslog_server) configures a node to store log messages locally and, optionally, relay them to another server.

The two profiles are compatible and can be used together on the same node, allowing a single host to both receive logs from other nodes and forward them onward.

SIEM integration and security telemetry

Security telemetry from edge nodes, SC//Reliant Management Plane systems, and corporate endpoints is forwarded in real time through the same rsyslog pipeline used for operational logs. Edge nodes forward syslog (authentication events, sudo and privileged-command logs, iptables denies, FIM events from Puppet FIM on Linux, and Windows audit forwarding via USFs) alongside Sensu-derived hardware and service status (disk, gateway, service health, USB attachment) over an encrypted IPsec or OpenVPN tunnel between the customer site and the cloud-hosted management plane.

Each node also acts as a log aggregator for the workloads running on it. Containerized workloads, including Endpoint Detection and Response (EDR) agents, security tools, and any other application deployed as a container, forward their stdout/stderr into rsyslog automatically when the container is started with the appropriate Linux capabilities (cap-add), so workload-level telemetry passes through the same forwarding, filtering, and routing features that apply to system logs. VM workloads can be configured to forward their logs to the on-node rsyslog endpoint as well. Management-plane API audit logging is captured by the native audit-log capability of the cloud where each customer's management plane is hosted, for example, AWS CloudTrail, Azure Activity Log, or Google Cloud Audit Logs.

Retention behavior and integrity controls at the destination depend on the customer's chosen SIEM or log platform and the applicable customer agreement.

Audit trail and compliance logging

Audit logs cover configuration changes (Puppet runs, SC//Reliant Platform Manager operations), access events (RBAC, login/logout), security events (FIM violations, firewall denies, package installs and removes), and transaction-level events. For customers subscribed to Scale Computing's managed vulnerability scanning service, scan findings are also forwarded through the audit pipeline.

Tamper protection is structural: logs are forwarded immediately via rsyslog to the central aggregator in the selected cloud, so once transmitted they are out of reach of an attacker who has compromised the edge node. Immutability, indexing, and forensic search at the destination are properties of the customer's chosen SIEM or log platform. Retention is configurable to meet PCI DSS, audit, and regional regulatory requirements.

Going deeper

The child pages below cover implementation and procedural detail for configuring rsyslog on the SC//Reliant platform.

• Reading logs on a node: where local logs live, how to read and filter them (including rotated .gz files), the anatomy of a log line, and handling the rsyslog spool when it fills a disk.
• Log filters: defining content-based filters to forward only the messages that are needed to external services.
• Configuring log forwarding: the profiles::rsyslog_client profile: forwarding system logs and log files to Rsyslog servers and third-party services (Elasticsearch, Datadog, New Relic), including queue tuning.
• Configuring local log storage: the profiles::rsyslog_server profile: storing log messages locally, controlling compression and retention, and acting as a relay to other servers.
• Deployment examples: typical end-to-end log-forwarding patterns and supported permutations.