2

If I install the splunk forwarder, I can get the remote data into my splunk install, and index my logs, and searching is great. But I have a number of router devices and other devices that run syslog, and can export their logs somewhere.

How can I configure Splunk to receive these logs, or is there some other workaround to be used?

  • Thanks for the answers. I'm off to configure splunk, and when it works, I'll be back to accpet answers! – Mister IT Guru Dec 29 '11 at 20:28
2

In the Splunk indexer's inputs configuration, you'll want to configure a UDP listener on port 514, with the type set to syslog (which allows it to figure out some of the default syslog fields) and the host set to the source of the traffic (which allows it to set the host field for the log items appropriately).

Once this is done, any standard syslog device can send data to the Splunk indexer, and it will be happily accepted by Splunk.

  • I didn't realise that splunk could 'talk' syslog! I'm worried about losing data though. If I reboot, will I lose the data in the mean time? – Mister IT Guru Dec 29 '11 at 20:27
  • @MisterITGuru Indeed you will; and with any UDP syslog, there's also potential for messages to be lost due to packet loss on the network - but with devices that aren't capable of sending their logs in any other way than UDP syslog, there's unfortunately nothing that you can do to mitigate that. – Shane Madden Dec 29 '11 at 20:37
1

There are quite a few articles online on how to set up Splunk to accept syslog connections. Here is one that I found with a simple Google search.

You basically just go into Splunk's management console and tell it to accept connections on X port from Y machine. That basically tells Splunk to accept those connections. Now you just have to go to each device and point that system's syslog to the Splunk IP on the correct port.

FYI - The Google search I used was: configure splunk to accept syslog

  • I didn't realise that splunk could 'talk' syslog! I'm worried about losing data though. If I reboot, will I lose the data in the mean time? – Mister IT Guru Dec 29 '11 at 20:27
  • No you shouldn't. There are settings that you can modify where the messages will queue up for X amount of time or X amount of tries before failing completely. Here is an article briefly talking about that - rsyslog.com/doc/rsyslog_reliable_forwarding.html. – Eric Dec 29 '11 at 21:42
  • ^^ only in TCP mode – dmourati Aug 8 '13 at 23:00
1

I know this is an old thread, but just commenting for anyone else who stumbles on it. The recommended approach is to funnel your syslog data through a syslog server like syslog-ng or Rsyslog. Then use a Splunk Universal Forwarder to monitor the log files and send off to your indexing layer. There are several reasons it is not recommended to just open a network port on a Splunk forwarder/indexer. Firstly being that UDP is stateless, and anytime Splunk has to be restarted, that data is just lost. And Splunk has to be restarted essentially anytime a configuration file is modigied, or an app is installed. Secondly, Splunk would have to be running as root to accept traffic on ports lower than 1024 and this is against best practice. It also violates many companies security policies.

-2

What I would to is a two step process. I would create a central syslog/syslog-ng server that can coalesce all your routers and other devices logs via syslog. Then, on that central syslog/syslog-ng server, run the splunk forwarder, configure it to tail the appropriate syslog file or files you configure, and forward that data to your central splunk server for indexing.

One other approach would be to make the syslog/syslog-ng server the same server as your central splunk. That would eliminate one forwarding step.

Good luck!

  • 2
    This is all totally unnecessary. Splunk already accepts syslog messages, TCP or UDP, totally natively. – jgoldschrafe Dec 29 '11 at 0:07
  • Ahh, thanks for setting the record straight. It has been a while since I've used Splunk and I needed a TCP syslog solution which wasn't integrated at that time. – dmourati Dec 29 '11 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.