Linux Server Logs

Connect Linux servers to Radiant Security to forward rsyslog system logs for AI triage.

Linux servers generate system, authentication, and service logs that record host activity relevant to detecting lateral movement, privilege escalation, and post-compromise behavior. Connecting Linux servers forwards rsyslog system logs to Radiant Security through the Radiant Agent over TCP syslog. Radiant uses Linux server logs to correlate host events with alerts from other connectors, giving analysts the supporting context needed to reach a verdict during AI triage.

Prerequisites

• Root access on each Linux server to forward logs from
• rsyslog package installed on each Linux server
• A deployed Radiant Agent reachable from the Linux servers

Add the data connector in Radiant Security

1. Log in to Radiant Security.
2. From the navigation menu, click Settings > Data Connectors, then click + Add Connector.
3. Search for and select Radiant Agent, then click Data Feeds.
4. Under Select your data feeds, select Linux Server Logs, then click Credentials.
5. Under Credential Name, enter an identifiable name for the Radiant Agent integration (e.g., Radiant Agent Integration). To reuse an existing Radiant Agent credential, select it from the drop-down menu.
6. Click Add Connector.

Configure rsyslog to forward logs

Before starting, confirm the IP address or hostname of the Radiant Agent and the port configured to receive Linux server logs. If you do not know the port, contact your Customer Success representative.

Repeat the following steps on each Linux server you want to forward logs from.

1. Open a root shell on the Linux server:

   sudo su -

Enter your password when prompted.

1. Verify rsyslog is installed:

   dpkg --list | grep rsyslog

If rsyslog is installed, the output is similar to ii rsyslog 8.2312.0-3ubuntu9.1. If the command returns no output, install rsyslog with apt install rsyslog.

The dpkg and apt commands apply to Debian and Ubuntu. On RHEL and derivatives, use rpm -q rsyslog and yum install rsyslog or dnf install rsyslog.

1. Create a new rsyslog configuration file in /etc/rsyslog.d/:

   nano /etc/rsyslog.d/100-radiant-agent.conf

1. Paste the following configuration into the file:

   action(
       type="omfwd"
       target="RADIANT_AGENT_HOST"
       port="RADIANT_AGENT_PORT"
       protocol="tcp"
       template="RSYSLOG_ForwardFormat"
       queue.type="linkedList"
   )

Replace the placeholders with the values you confirmed at the start of this section:

• RADIANT_AGENT_HOST: the IP address or hostname of the Radiant Agent.
• RADIANT_AGENT_PORT: the port configured on the Radiant Agent to receive Linux server logs.

The queue.type="linkedList" setting prevents rsyslog from blocking on the local host if the Radiant Agent becomes unreachable. Buffered messages are forwarded once the agent is reachable again.

1. Save the file by pressing Ctrl + O, then Enter. Exit nano by pressing Ctrl + X.
2. Confirm the configuration file was created:

   ls /etc/rsyslog.d/100-radiant-agent.conf

The command should return the full file path. If it returns No such file or directory, repeat steps 3 through 5.

1. Restart the rsyslog service:

   systemctl restart rsyslog

1. Confirm the service is running:

   systemctl status rsyslog

The output should include Active: active (running).

Once rsyslog has been configured on every Linux server in scope, the Radiant Agent receives logs from each server on the configured port and forwards them to Radiant for AI triage.

Verify ingestion

After Linux begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"linux_server_logs".
3. Confirm recent events appear.

Allow several minutes for events to be parsed, indexed, and available for search.