Remote syslog

Forward selected log facilities to an off-box collector (a managed block in /etc/syslog.conf). UDP (@host), TCP (@tcp://host:port) and TLS (@tls://host) are supported. TLS verifies the collector certificate against the system CA bundle by default; a custom CA and a mutual-TLS client certificate can be configured below.

{{#ERROR}}
{{ERROR}}
{{/ERROR}} {{#FLASH}}
{{FLASH}}
{{/FLASH}} {{#WRITE}}
{{/WRITE}}

Collector

Pick the transport, the collector host (an FQDN or IP literal), an optional port (blank uses 514 for UDP/TCP, 6514 for TLS), and which facilities to forward.

A syslogd selector, e.g. *.* (everything) or daemon.info. Letters, digits and . * , ; only.

Every audit record is mirrored to the reserved local7.info syslog facility with its integrity fields (gen/seq/epoch/mac). Forwarding it off-box is the only mitigation for on-box tampering by a compromised root/authd — the off-box copy can be verified independently. Prefer TCP or TLS for the audit stream (UDP is lossy and length-limited).

{{#TLS}}

TLS trust & client certificate

Optional. For a privately-signed collector (custom CA) or a collector that requires mutual TLS (client certificate). Place the PEM files under /etc/ssl/ogma-remotelog/ (a root-owned 0700 directory; the client key 0600) and reference them by absolute path here.

A custom CA replaces the system bundle for verifying the collector — include every CA needed to chain the collector certificate. Leave blank to use the system trust store (/etc/ssl/cert.pem).

For mutual TLS set both the client certificate and key — the router presents this identity to the collector. Set neither for server-only TLS.

{{/TLS}} {{#PUBLIC_WARN}}
Security: this collector looks like a public / internet-facing host. Forwarding logs off-network sends operational data (and possibly secrets in log lines) to a third party. Confirm you intend this export below.
{{/PUBLIC_WARN}} {{#CONFIRM}} {{/CONFIRM}} {{#WRITE}}
{{/WRITE}}