Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have running centralized syslog server (rsyslog on CentOS6, which works perfect). Next step it was to add Splunk as a syslog analyzing tool. All was installed perfectly - Splunk works, can log in to the front end and add data source (TCP port 514) but from there I don't see any data indexed by Splunk.

rysylog config for data storage and processing looks like:

$ModLoad ommysql
$ModLoad ommysql
*.* :ommysql:127.0.0.1,rsysdb,rsyslog,password
*.* @@localhost

Any clue why Splunk is not receiving any data?

Thanks

share|improve this question
    
It is very difficult to predict what is wrong with your setup. Most probably you did not configure the data source properly. –  AdnanG Sep 10 '13 at 12:55
    
While Splunk can often be used in the place of a SIEM or for security operations it is not necessarily a security tool. You may find more expertise in this tool at our sister site for Information Technology Professionals Server Fault. –  Scott Pack Sep 10 '13 at 13:29
    
@ScottPack thanks for pointing me to the proper site –  JackTheKnife Sep 11 '13 at 19:38
add comment

migrated from security.stackexchange.com Sep 10 '13 at 18:29

This question came from our site for Information security professionals.

1 Answer

up vote 0 down vote accepted

Well, got issue resolved by using local IP instead a domain 'localhost' so line for syslog forwarding to Splunk (TCP connection) looks like

*.* @@127.0.0.1

as is on the same server as rsyslog. Splunk is set to listen to TCP port 514 data set as syslog.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.