cat << 'EOF' > /tmp/setup_syslog.sh
#!/bin/bash

# Configuration
LOG_SERVER="172.16.1.227"
PORT="514"
PROTO="udp" # 'udp' is standard for simple 514, use 'tcp' if you configured TCP on server

# Detect OS and Install rsyslog
echo "[+] Detecting OS..."
if [ -f /etc/debian_version ]; then
echo "Detected Debian/Ubuntu/Kali family."
# Update quietly and install rsyslog + netcat for testing
apt-get update -qq && apt-get install -y -qq rsyslog netcat-openbsd
elif [ -f /etc/redhat-release ]; then
echo "Detected RHEL/CentOS/Oracle family."
# Install rsyslog + nc for testing
if command -v dnf &> /dev/null; then
dnf install -y rsyslog nc
else
yum install -y rsyslog nc
fi
else
echo "[-] Unsupported OS. Exiting."
exit 1
fi

# Enable and Start Service (ensure it survives reboots)
echo "[+] Enabling rsyslog service..."
systemctl enable rsyslog
systemctl start rsyslog

# Configure Forwarding
# We use a separate file in /etc/rsyslog.d/ to avoid breaking existing setups
CONFIG_FILE="/etc/rsyslog.d/99-remotelog.conf"
echo "[+] Configuring forwarding to $LOG_SERVER..."

# Legacy syntax is safest for mixed versions (Kali vs Old Ubuntu vs RHEL)
# UDP Syntax: *.* @IP:PORT
# TCP Syntax: *.* @@IP:PORT
if [ "$PROTO" == "tcp" ]; then
echo "*.* @@$LOG_SERVER:$PORT" > "$CONFIG_FILE"
else
echo "*.* @$LOG_SERVER:$PORT" > "$CONFIG_FILE"
fi

# Restart to apply
systemctl restart rsyslog

# Validation
echo "--- Validation ---"

# 1. Ping Check
if ping -c 2 $LOG_SERVER &> /dev/null; then
echo "[PASS] $LOG_SERVER is reachable via ICMP."
else
echo "[FAIL] Cannot ping $LOG_SERVER. Check network/firewall."
fi

# 2. Port Reachability (Netcat)
# -u for UDP, -z for scanning, -w 2 for 2 second timeout
if nc -z -u -w 2 $LOG_SERVER $PORT; then
echo "[PASS] Port $PORT ($PROTO) is open/reachable."
else
echo "[WARN] Port check failed. (Note: UDP often gives false negatives)."
fi

# 3. Send Test Log
logger -p syslog.info "REMOTE_LOG_TEST: Setup complete on $(hostname)"
echo "[+] Test log sent with tag 'REMOTE_LOG_TEST'. Check your server."

EOF
chmod +x /tmp/setup_syslog.sh && sudo /tmp/setup_syslog.sh && rm /tmp/setup_syslog.sh