Add syslog output

[WilliamBruneau]

Some SIEM can only receive logs in syslog messages. To support these SIEM, we need to add a syslog output.

cf RFC 5424.

It may be useful to add 2 variant of syslog output for TCP and UDP.

[MrAnno]

Until this is implemented, a workaround can be (and an overkill) using the unixdatagram output to forward raw events to a tool that can process them further to conform to the requirements of different SIEMs.

https://github.com/cea-sec/openwec/blob/main/doc/outputs.md#unix-domain-socket

We do something similar using OpenWEC together with syslog-ng.

[necouchman]

I'll also add that a nice-to-have would be output to systemd-journald-remote, in the journald format, which has largely supplanted syslog on newer Linux distributions.

[a139786]

I have OpenWEC and rsyslog sharing a box - OpenWEC writing to files rsyslog reads from. That way any issues with the syslog server don't result in loss of logs. HTH.