Defensive › Module 7 › Lesson 4
Central Lab
Forward $LAB Linux syslog to $LAB collector — verify arrival; no stranger ingestion.
Visual · t16_central_lab
Lab: central collect on $LAB fleet. Original Cyberlium.
Opening
Prove one log line landed in the collector — not that you swallowed the internet's syslog.
On isolated lab net: configure $LAB Linux to forward one facility (e.g., local0) to $LAB collector syslog listener. Generate a test logger line (logger 'cyberlium-lab-test'). Confirm arrival in collector file or UI. Document forwarder config snippet redacted. Windows optional: note WEF subscription on paper if no lab DC. Teardown: remove forwarder config or shut lab VLAN. Never forward production or classmate logs.
1. Collector setup
rsyslog listener or minimal syslog-ng on $LAB collector — lab network only.
Firewall allow syslog port only from $LAB client IPs.
Command guide
Try these commands — Collector setup
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Central logging lab — https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
journalctl -n 30 --no-pager 2>/dev/null | python3 -c "import sys; print(sys.stdin.read().count(chr(10)),'lines ready to ship')"
curl -sS http://127.0.0.1:9200/_cluster/health 2>/dev/null | python3 -m json.tool 2>/dev/null | head -10 || curl -sS http://127.0.0.1/ -o /dev/null -w "health probe %{http_code}
"Primary tools to practice this lesson: curl, journalctl, python3. Reference sites: Central logging lab (https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Forward and test
Client @@collector:514 or TLS equivalent per distro docs.
logger test message; grep collector storage for string.
3. Teardown
Revert rsyslog.d drop-in. Stop listener if not needed.
chmod 600 config snippets in notes.
4. What you ship: central lab evidence
Test log line received + redacted config + teardown note.
5. What you record before the next lesson
Central lab notes path.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Open syslog listener to 0.0.0.0 on home WAN for 'more data.'
Right
Lab forward verified. Next: quiz.
Mission: central logging lab
1) Start collector on $LAB. 2) Forward and send test logger line. 3) Confirm receipt; teardown; secure notes.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “TCP vs TLS syslog?”
Knowledge Check
APPLY: Central lab proves:
Multiple choice
Knowledge Check
APPLY: True or False: 0.0.0.0 syslog listener on WAN is lab.
True or False
Knowledge Check
APPLY: Test message tool on Linux:
Multiple choice