Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have a server in my home lab running Splunk, really love it. I'm soon going to have another server in the EC2 cloud, and I'd love to be able to monitor that using Splunk, hopefully though the primary Splunk server I already have setup.

Now, I don't plan on having a VPN connection set up between the two servers, I don't have the proper hardware to allow that currently sadly. So, what would be the best way to feed data from my remote EC2 server to my local one?

share|improve this question
    
Getting a VPN set up doesn't require any special hardware - check out OpenVPN. –  EEAA Jan 31 '12 at 20:51
    
@ErikA - Each time I've used OpenVPN with EC2, the EC2 instance totally loses t's network connection and I'm unable to access it, even after reboots. –  Chiggins Jan 31 '12 at 20:55
    
That's a configuration issue. Do a test install locally in a linux server running in virtualbox. –  EEAA Jan 31 '12 at 20:58
    
@ErikA - I'll try that when I get home later. –  Chiggins Jan 31 '12 at 21:00

1 Answer 1

Splunk's native event forwarding protocol can run over SSL; if you're able to allow a TCP connection from the EC2 node back to your primary indexer, then that method should cover your needs without a lot of extra effort.

share|improve this answer
    
So I'd be able to transmit over SSL, without needing a VPN? Would I have to create my own certs or would Splunk do that for me? –  Chiggins Jan 31 '12 at 22:51
    
Right - I believe it does generate a cert on the indexer by default; not sure about the forwarder (assuming that you use the universal forwarder agent install).. you may need to generate one for that. –  Shane Madden Jan 31 '12 at 22:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.