Step 1

Set up a Linux machine within the data center with sufficient storage capacity (based on the volume of logs to be maintained) to serve as the logging server. This server should be accessible from the VPN-less reverse proxy.

Step 2

Install rsyslog and rsyslog-gnutls in the logging server.

Step 3

Create a configuration file for rsyslog in the configuration directory of rsyslog (/etc/rsyslog.d in most Linux distributions) in the logging server as shown below:

# Setup disk assisted queues
$WorkDirectory /tmp/rsyslog # where to place spool files
$ActionQueueFileName fwdRule1   # unique name prefix for spool files
$ActionQueueMaxDiskSpace 1g    # 1gb space limit (use as much as possible)
$ActionQueueSaveOnShutdown on   # save messages to disk on shutdown
$ActionQueueType LinkedList    # run asynchronously
$ActionResumeRetryCount -1    # infinite retries if host is down
 
# Set the tls provider as gnutls
$DefaultNetstreamDriver gtls
 
# certificate files
# Trust file contains the certificate(s) of reverse proxy(or proxies)
# and the self signed/CA-signed certificate(chain) generated for
# this logging server(server-cert.pem). Created using
# 'cat nginx.crt /home/<user>/ssl/server-crt.pem > /home/<user>/ssl/trust.pem'
$DefaultNetstreamDriverCAFile /home/<user>/ssl/trust.pem
$DefaultNetstreamDriverCertFile /home/<user>/ssl/server-cert.pem
$DefaultNetstreamDriverKeyFile /home/<user>/ssl/server-key.pem
 
 
$ModLoad imtcp  # TCP listener
$InputTCPServerStreamDriverMode 1  # run driver in TLS-only mode
$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerRun 5001  # start up listener at port 5001

Step 4

In the installer.env file of reverse proxy:

1. Set the NGX_LIVE_LOG_SHIPPING_ENABLED property to true.

2. Set the logging server hostname in the NGX_LIVE_LOG_SHIPPING_SERVER_HOST property.

3. Set the logging server port in the NGX_LIVE_LOG_SHIPPING_SERVER_PORT property.

Step 5

For enabling mTLS between the reverse proxy and the logging server:

1. Generate a self-signed certificate or procure a CA-signed certificate in PEM format for the logging server, with the corresponding private key. For more information, see the Install Certification Authority (CA) Certificate section in the Single Sign-On chapter in the Cisco Unified Contact Center Enterprise Features Guide.

2. In the installer.env file of reverse proxy:

   1. Set the value of the NGX_LIVE_LOG_SERVER_CRT_AUTH property to 1.

   2. Set the value of the NGX_LIVE_LOG_SHIPPING_CLIENT_CERT property to the reverse proxy certificate to be used for mTLS.

   3. Set the value of the NGX_LIVE_LOG_SHIPPING_CLIENT_KEY property to the reverse proxy's private key corresponding to the certificate.

3. In the reverse proxy, copy the public key certificate of the logging server to the directory ${HOST_WORKING_DIR}/ssl and rename it to logging_server.crt.

4. In the logging server:

   1. Copy the public certificate of reverse proxy to a specific location in the logging server.

   2. Create a trust store by appending all the certificates of the rsyslog clients into a single file, so that multiple reverse proxies can send logs to this server.

   3. Set the path to the trust store (/home/<user>/ssl/trust.pem in the sample configuration) in the DefaultNetstreamDriverCAFile property in the rsyslog configuration.

   4. Set the paths to logging server's certificate and key into the DefaultNetstreamDriverCertFile and DefaultNetstreamDriverKeyFile properties respectively in the rsyslog configuration.

   5. Set the DefaultNetstreamDriver property to gtls to use gnu-tls as the TLS provider.

   6. Set the value of the InputTCPServerStreamDriverMode property to 1 (to enable TLS).

   7. Set the value of the InputTCPServerRun property to the port to which the logging should happen (5001 in the sample configuration).

Step 6

If required, set the paths of the logs in the logging server (see https://www.rsyslog.com/doc/master/configuration/examples.html for samples).

Step 7

Ensure that log rotation is enabled in the logging server, to avoid disk space exhaustion, using an appropriate log rotate tool.

Step 8

Start the rsyslog service in the logging server (in Linux distributions, it is usually performed using the systemctl start rsyslog or service rsyslog start commands).

Step 9

Start the reverse proxy container.

Step 10

Ensure that the reverse proxy logs are shipped live into the logging server by monitoring the log directory in that server.