Overview Network Tools Proxy64 Plugin Manager Remote Logger Web Application Firewall Datadog Bastillion Speed Test Network Intrusion Detection Plugin with Suricata PingProxy Driver PingProxy HAProxy-Plugin Manager Do Name Stuff ntop CloudWatch Logs Telegraf Plugin HTTPS Certs Manager LDAP VNS3 HA Plugin OWASP ZAP Container PacketLoss Overlay Engine

Remote Logger

Overview

This VNS3 Plugin forwards plaintext log files from mounted host directories to external log/SIEM targets, along with SSH access for remote troubleshooting. Routing is driven by a single, human-readable configuration file — no rsyslog syntax knowledge required. The Plugin is managed by Supervisor and validates its configuration on every start, refusing to start log forwarding on a broken config rather than running silently with a bad setup.

Features

• Forwards mounted log files to external SIEM/log targets over plain syslog (UDP or TCP)
• Routing configured through a single, human-readable file — no rsyslog syntax required
• Configuration is validated on every start; an invalid routing file is reported clearly instead of silently breaking log delivery
• SSH access for remote troubleshooting

Supported Log Targets

Plain syslog over UDP

• rapid7 (Rapid7 InsightIDR)
• qradar (IBM QRadar)
• logrhythm (LogRhythm)
• solarwinds (SolarWinds)
• papertrail (Papertrail)
• loggly (Loggly)
• syslog_udp (any other UDP syslog collector)

Structured syslog over TCP

• splunk (Splunk)
• arcsight (ArcSight / OpenText)
• syslog_tcp (any other TCP syslog collector expecting a structured header)

Getting Started

1. Upload the Plugin Image from the Public Catalog

1. Navigate to the Plugin Catalog, available under the Plugins left column menu section.
2. Click Install under the Remote Logger Plugin.
3. Click Install on the resulting modal popup.

2. Start the Plugin

1. Navigate to the Plugin Dashboard, available under the Plugins left column menu section.
2. On the Images tab, confirm the Remote Logger plugin status is “Ready” then click Start Instance from the Actions drop down menu.
3. Provide a plugin name and optionally select the plugin IP and click Start on the resulting modal popup.

3. Configure Cloud and VNS3 Firewall for Access

1. On the Instances tab, the Remote Logger plugin IP will be displayed. This IP will be used in the two temporary Firewall rules that will be needed.
2. Navigate to the Firewall, available under the Connections left column menu section and add the following rules substituting <plugin_ip> for the IP address of the Remote Logger plugin from step 3.1:

#Let the Remote Logger Plugin Access the local VNET and Internet Via the VNS3 Controller’s primary network interface
POSTROUTING -o eth0 -s <plugin_ip> -j MASQUERADE-ONCE
FORWARD -s <plugin_ip> -j ACCEPT
#Port forward port 44 to the Plugin port 22
PREROUTING_CUST -i eth0 -p tcp --dport 44 -j DNAT --to <plugin_ip>:22
FORWARD -d <plugin_ip> -j ACCEPT

3. Open inbound port 44 (or select another port but make sure to change the Firewall rule from the previous step) access from your IP (whatismyip.com) on the VNS3 controller’s security group.

The first rule (MASQUERADE-ONCE/FORWARD) is what lets the plugin reach your SIEM/log targets out over the internet (or across the VNET) in the first place — without it, log forwarding has no route out regardless of how logger-routes.toml is configured.

4. Configure SSH Credentials

1. Navigate to the Plugin Dashboard, available under the Plugins left column menu section.
2. On the Instances tab, click Manage from the Actions drop down menu for the Remote Logger Plugin.
3. On the resulting page, click the SSH button at the bottom of the left column.
4. On the resulting modal popup, click the Create / Update User tab.
5. Enter a username and password and click Save user.

5. Access the Plugin

1. Open a terminal (Linux/macOS) or PowerShell/Command Prompt (Windows) and run the following command, replacing with the username created in 4.5 above and <vns3_ip> with the public IP of the VNS3 controller:

ssh -p 45 <username>@<vns3_ip>

2. Enter the password created in 4.5 above.

Putting it all together - Configuring Log Forwarding

Available Log Files

Log Files available via the Logging Container:

/mnt/logs/auth.log
/mnt/logs/boot.log
/mnt/logs/dmesg
/mnt/logs/kern.log - VNS3 kernel log
/mnt/logs/syslog - VNS3 system log
/mnt/logs/version.log - VNS3 version
/mnt/logs/vnscubed_api_background.log
/mnt/logs/vnscubed_api_server.log
/mnt/logs/vnscubed_bgpmon.log
/mnt/logs/vnscubed_monitor.log
/mnt/logs/vnscubed_webui.log
/mnt/logs/webserver_access.log
/mnt/logs/webserver_error.log
/mnt/logs/vnscubed_connection_logs/ipsec.log - IPsec system log
/mnt/logs/vnscubed_connection_logs/tun0.log - Overlay Network server connection log
/mnt/logs/vnscubed_connection_logs/bgpd.log - Border Gateway Protocol daemon log
/mnt/logs/vnscubed_connection_logs/unauthorized.log

These are the paths to use as file in a [[route]] block below.

Log file rotation

VNS3 controllers rotate log files to both ensure a useful log history is available at all times without taking up too much disk.

Log files on VNS3 are rotated weekly with a history of 14 log files compressed and retained. As a result the previously mentioned log directory available in the Logging Container (/mnt/logs) may include some additional historical files.

Editing the routing configuration

Log routing is defined entirely in one file, logger-routes.toml, which the plugin re-reads and re-validates every time it starts.

1. Navigate to the Plugin Dashboard, available under the Plugins left column menu section.
2. On the Instances tab, click Manage from the Actions drop down menu for the Remote Logger Plugin.
3. On the resulting page, click the Edit button on the right side of the Plugin Manager to open /etc/logger-routes.toml directly in a text box.
4. Add one [[route]] block per log source you want forwarded:

[[route]]
file   = "/mnt/logs/vnscubed_connection_logs/ipsec.log"
target = "rapid7"
host   = "192.168.1.50"
port   = 10514

[[route]]
file   = "/mnt/logs/syslog"
target = "rapid7"
host   = "192.168.1.50"
port   = 10515

• file — the log path as mounted into the plugin under /mnt (glob patterns like *.log are supported).
• target — one of the target keywords listed above under Supported Log Targets.
• host — the hostname or IP of your log/SIEM destination.
• port — optional; defaults to 514 if not set.

5. To send the same file to more than one target, add another [[route]] block with the same file value and a different target:

[[route]]
file   = "/mnt/logs/vnscubed_connection_logs/ipsec.log"
target = "rapid7"
host   = "192.168.1.50"

[[route]]
file   = "/mnt/logs/vnscubed_connection_logs/ipsec.log"
target = "splunk"
host   = "splunk-forwarder.internal"

6. Click Save.
7. Restart the plugin instance (Actions drop down menu > Restart Instance) to apply the change — the configuration is only read when the plugin (re)starts.

Checking that a change was applied

If rsyslog doesn’t come back up after a restart, or forwarded logs aren’t arriving, check these two log files from the Plugin Dashboard’s log viewer (Manage > Logs):

• translate.log — shows whether your logger-routes.toml edit was valid. If a route is missing a required field, uses an unknown target, or has any other problem, the specific reason is written here and the plugin will not start log forwarding until it’s fixed.
• rsyslog.stderr.log — shows rsyslog’s own runtime output, useful if translate.log reports success but logs still aren’t reaching the destination (e.g. a network firewall issue reaching the target).