I am trying to Forward syslogs and Event Logs across networks (internet).
Win Computer ----| (There will be multiples of these forwarding to a single source) Win Server ------| >> Internal Syslog Server >> || >> External Syslog Server >> Splunk Win Server ------| Win Router ------|
I am wondering what it would take to implement this (I can get the logs to the Internal Syslog Server), but my issue is insuring that all the logs from the internal server are kept authentic and look the same when they get to splunk without being changed. Also will likely needs encryption.
There will be 4-5 different different Internal Syslog Servers forwarding to this external source.
So my question about this is, do I go with rsyslog, syslog-ng etc.. or do I go with a VPN on the Internal Syslog Server forwarding the events through the VPN?
If syslog forwarding using encryption/TCP is better then is it possible/doable?