aws-quickstart / quickstart-linux-bastion

Linux bastion host

Home Page:https://aws-quickstart.github.io/quickstart-linux-bastion/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Why is there no /var/log/bastion/bastion.log file

FFTU opened this issue · comments

commented

I follow the tutorial configuration in https://docs.aws.amazon.com/quickstart/latest/linux-bastion/welcome.html, but there is no log file;no /var/log/bastion/bastion.log and Linux-bastion-BastionMainLogGroup log stream is empty
ec2 Amazon Linux(amzn2-ami-hvm-2.0.20200722.0-x86_64-gp2)

thanks

commented

5472050

Log file output destination changed

/var/log/bastion/bastion.log ⇒ /var/log/auditd/auditd.log

However, the logs have not been transferred to CloudWatch ...
Linux-bastion-BastionMainLogGroup log stream is empty ...
why?

commented

Because there is an error in the file path of the transfer settings
Not transferred to CloudWatch

Wrong: /var/log/auditd/auditd.log
Correct: /var/log/audit/audit.log
■quickstart-linux-bastion/scripts/bastion_bootstrap.sh
Line:123 ~ 142

    cat <<EOF >> /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json
{
    "logs": {
        "force_flush_interval": 5,
        "logs_collected": {
            "files": {
                "collect_list": [
                    {
                        "file_path": "/var/log/auditd/auditd.log",  ★「/var/log/audit/audit.log」 is correct
                        "log_group_name": "${CWG}",
                        "log_stream_name": "{instance_id}",
                        "timestamp_format": "%Y-%m-%d %H:%M:%S",
                        "timezone": "UTC"
                    }
                ]
            }
        }
    }
}
EOF

Here facing the same issue, this is a problem when trying to audit logs, which is one of the main reasons we implemented a bastion.

Hi,

In which file or directory do I find the configuration of bastion.log file please ?
I can't find it.