Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I install the splunk forwarder, I can get the remote data into my splunk install, and index my logs, and searching is great. But I have a number of router devices and other devices that run syslog, and can export their logs somewhere.

How can I configure Splunk to receive these logs, or is there some other workaround to be used?

share|improve this question
    
Thanks for the answers. I'm off to configure splunk, and when it works, I'll be back to accpet answers! –  Mister IT Guru Dec 29 '11 at 20:28
add comment

3 Answers

In the Splunk indexer's inputs configuration, you'll want to configure a UDP listener on port 514, with the type set to syslog (which allows it to figure out some of the default syslog fields) and the host set to the source of the traffic (which allows it to set the host field for the log items appropriately).

Once this is done, any standard syslog device can send data to the Splunk indexer, and it will be happily accepted by Splunk.

share|improve this answer
    
I didn't realise that splunk could 'talk' syslog! I'm worried about losing data though. If I reboot, will I lose the data in the mean time? –  Mister IT Guru Dec 29 '11 at 20:27
    
@MisterITGuru Indeed you will; and with any UDP syslog, there's also potential for messages to be lost due to packet loss on the network - but with devices that aren't capable of sending their logs in any other way than UDP syslog, there's unfortunately nothing that you can do to mitigate that. –  Shane Madden Dec 29 '11 at 20:37
add comment

There are quite a few articles online on how to set up Splunk to accept syslog connections. Here is one that I found with a simple Google search.

You basically just go into Splunk's management console and tell it to accept connections on X port from Y machine. That basically tells Splunk to accept those connections. Now you just have to go to each device and point that system's syslog to the Splunk IP on the correct port.

FYI - The Google search I used was: configure splunk to accept syslog

share|improve this answer
    
I didn't realise that splunk could 'talk' syslog! I'm worried about losing data though. If I reboot, will I lose the data in the mean time? –  Mister IT Guru Dec 29 '11 at 20:27
    
No you shouldn't. There are settings that you can modify where the messages will queue up for X amount of time or X amount of tries before failing completely. Here is an article briefly talking about that - rsyslog.com/doc/rsyslog_reliable_forwarding.html. –  Eric Dec 29 '11 at 21:42
    
^^ only in TCP mode –  dmourati Aug 8 '13 at 23:00
add comment

What I would to is a two step process. I would create a central syslog/syslog-ng server that can coalesce all your routers and other devices logs via syslog. Then, on that central syslog/syslog-ng server, run the splunk forwarder, configure it to tail the appropriate syslog file or files you configure, and forward that data to your central splunk server for indexing.

One other approach would be to make the syslog/syslog-ng server the same server as your central splunk. That would eliminate one forwarding step.

Good luck!

share|improve this answer
2  
This is all totally unnecessary. Splunk already accepts syslog messages, TCP or UDP, totally natively. –  jgoldschrafe Dec 29 '11 at 0:07
    
Ahh, thanks for setting the record straight. It has been a while since I've used Splunk and I needed a TCP syslog solution which wasn't integrated at that time. –  dmourati Dec 29 '11 at 17:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.