https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47403#M13876 <P>Thanks that worked great.</P> Thu, 28 Feb 2013 21:38:46 GMT jalfrey 2013-02-28T21:38:46Z https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47401#M13874 <P>I'm setting up logging with Sonicwall firewalls. They support syslog. Do I send it to syslog on a linux system or send it directly to splunk via a port? If I setup multiple firewalls to log the same instance and I use the system syslog do I separate the log files in the syslog configuration? </P> Thu, 28 Feb 2013 19:50:09 GMT https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47401#M13874 jalfrey 2013-02-28T19:50:09Z https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47402#M13875 <P>You can send your syslog events directly to Splunk. <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Monitornetworkports">Just setup up a UDP input</A> (default port 514 for syslog) or a non default port if you wish.</P> <P>You'll then be able to search and categorize your syslog events in Splunk based on which host (sonic firewall) they came from, or any other fields in the syslog event that identify the origin.You can also dynamically set the source and sourcetype or route the syslog events to different indexes when everything is coming in over the same UDP port using entrys in transforms.conf.</P> Thu, 28 Feb 2013 20:01:28 GMT https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47402#M13875 Damien_Dallimor 2013-02-28T20:01:28Z https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47403#M13876 <P>Thanks that worked great.</P> Thu, 28 Feb 2013 21:38:46 GMT https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47403#M13876 jalfrey 2013-02-28T21:38:46Z https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47404#M13877 <P>This may also be of interest: <A href="http://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input">http://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input</A></P> Fri, 01 Mar 2013 17:12:13 GMT https://community.splunk.com/t5/Security/best-practices-for-logging/m-p/47404#M13877 dshpritz 2013-03-01T17:12:13Z