From 1ed69d35b64f1e5031abed6aeccd1240dce16a9d Mon Sep 17 00:00:00 2001 From: rcourtman Date: Fri, 14 Nov 2025 10:39:10 +0000 Subject: [PATCH] docs: highlight runbooks in index and script verification checklist --- docs/README.md | 13 +++++++++---- scripts/setup-log-forwarding.sh | 6 ++++++ 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/docs/README.md b/docs/README.md index 81b1c67..6c3b39f 100644 --- a/docs/README.md +++ b/docs/README.md @@ -11,6 +11,11 @@ section groups related guides so you can jump straight to the material you need. - [FAQ.md](FAQ.md) – Common questions and troubleshooting quick answers. - [MIGRATION.md](MIGRATION.md) – Export/import process for moving between hosts. - [DEV-QUICK-START.md](../DEV-QUICK-START.md) – Hot reload workflow for local development. +- **Post-install checklist** + - [operations/audit-log-rotation.md](operations/audit-log-rotation.md) – Schedule regular sensor proxy log rotations after your first installation. + - [operations/sensor-proxy-log-forwarding.md](operations/sensor-proxy-log-forwarding.md) – Forward audit/proxy logs to your SIEM as soon as compliance retention is required. + - [operations/auto-update.md](operations/auto-update.md) – Enable and verify the `pulse-update` timer before handing the system to on-call. + - [operations/ADAPTIVE_POLLING_ROLLOUT.md](operations/ADAPTIVE_POLLING_ROLLOUT.md) – Plan the rollout when turning on adaptive polling beyond lab environments. ## Deployment Guides @@ -40,10 +45,10 @@ section groups related guides so you can jump straight to the material you need. ## Operations Runbooks -- [operations/audit-log-rotation.md](operations/audit-log-rotation.md) – Rotate sensor proxy audit logs safely. -- [operations/ADAPTIVE_POLLING_ROLLOUT.md](operations/ADAPTIVE_POLLING_ROLLOUT.md) – Step-by-step adaptive polling rollout guide. -- [operations/auto-update.md](operations/auto-update.md) – Manage the automatic update timer/service. -- [operations/sensor-proxy-log-forwarding.md](operations/sensor-proxy-log-forwarding.md) – Forward sensor proxy logs to a SIEM over RELP + TLS. +- [operations/audit-log-rotation.md](operations/audit-log-rotation.md) – Monthly/incident log rotation procedure that preserves the hash chain and validates scheduler health afterward. +- [operations/ADAPTIVE_POLLING_ROLLOUT.md](operations/ADAPTIVE_POLLING_ROLLOUT.md) – Rollout/rollback plan for enabling adaptive polling in staging or production. +- [operations/auto-update.md](operations/auto-update.md) – Lifecycle of the `pulse-update` timer/service: enablement, manual trigger, rollback, and observability. +- [operations/sensor-proxy-log-forwarding.md](operations/sensor-proxy-log-forwarding.md) – Configure rsyslog + RELP/TLS to ship sensor proxy audit/proxy logs to centralized logging. ## Reference diff --git a/scripts/setup-log-forwarding.sh b/scripts/setup-log-forwarding.sh index 00609b8..32f4087 100755 --- a/scripts/setup-log-forwarding.sh +++ b/scripts/setup-log-forwarding.sh @@ -60,3 +60,9 @@ EOF systemctl restart rsyslog echo "Log forwarding enabled to $REMOTE_HOST:$REMOTE_PORT" + +# Verification checklist: +# 1. sudo rsyslogd -N1 (syntax check) +# 2. sudo systemctl status rsyslog --no-pager +# 3. tail -f /var/log/pulse/sensor-proxy/forwarding.log +# 4. Confirm new `pulse.audit` events arrive on the remote collector