From 6ac38fcb19c9b98090a00ad1d02168fcc51d308e Mon Sep 17 00:00:00 2001
From: Koen Van Impe <koen.vanimpe@cudeso.be>
Date: Wed, 8 Jan 2025 16:38:21 +0100
Subject: [PATCH] Include rsyslog for local syslogger

Possible rsyslog file can be: /etc/rsyslog.d/40-misp.conf

```
global(parser.PermitSlashInProgramname="on")

if (
    (
        $programname == '/var/www/MISP/app/tmp/logs/' or
        $programname == 'MISP-SYNC' or
        $programname == 'MISP-SCRIPTS'
    ) and not (
        $msg contains 'contracts.canonical.' or
        $msg contains 'ubuntupro.http'
    )
)

then /var/www/MISP/app/tmp/logs/mispsyslog.log

& stop
```
---
 core/Dockerfile                                     | 3 +++
 core/files/etc/supervisor/conf.d/10-supervisor.conf | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/core/Dockerfile b/core/Dockerfile
index 57ec171..b9e46d1 100644
--- a/core/Dockerfile
+++ b/core/Dockerfile
@@ -262,6 +262,9 @@ EOF
         touch /var/www/MISP/.git/ORIG_HEAD && chmod 0600 /var/www/MISP/.git/ORIG_HEAD && chown www-data:www-data /var/www/MISP/.git/ORIG_HEAD
 EOF
 
+    # Include rsyslog to support syslogger
+    RUN apt-get update ; apt-get install -y rsyslog
+
     # Copy all our image specific files to appropriate locations
     COPY files/ /
     ENTRYPOINT [ "/entrypoint.sh" ]
diff --git a/core/files/etc/supervisor/conf.d/10-supervisor.conf b/core/files/etc/supervisor/conf.d/10-supervisor.conf
index 8b7c81f..fde3172 100644
--- a/core/files/etc/supervisor/conf.d/10-supervisor.conf
+++ b/core/files/etc/supervisor/conf.d/10-supervisor.conf
@@ -37,3 +37,12 @@ stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
+
+[program:rsyslog]
+command=/usr/sbin/rsyslogd -n
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+autostart=true
+autorestart=true