topic Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network? in All Apps and Add-ons

Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Sun, 05 Feb 2017 19:09:21 GMT

I am not very network savvy. Trying to get my home router to syslog to Splunk to look at connection info in the Home Monitor app.

I can see events in the bandwidth_test sourcetype, so I know that I have the app running .
If I go to settings|Data inputs|UDP, I can see UDP port 514 enabled with source type RT-N66U
And in Windows Firewall, I can see that I have created an inbound rule called Splunk Syslog, which allows local port UDP 514, and remote port: all ports
On my RT-N66U router I have set remote log server to my Splunk install's IP address.

But in app, I see no logs and in the search app, I do not see events from syslog or RT-N66U or asus.
I tried running netstat -p UDP, that returns nothing. netstat -p TCP does return a lot of high ports and 8000, 8191 (I think these are the Splunk app)

Any clues/advise on what I am missing?

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

amiracle — Mon, 06 Feb 2017 15:48:41 GMT

First thing I would do is change the sourcetype from RT-N66U to asus. Check out this wiki entry that walks you through why having the sourcetype asus is necessary for the app:
https://github.com/amiracle/homemonitor/wiki/Configure-home-monitor-app-for-Splunk

Let me know if that helps with your setup.

Thanks,
Kam

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Mon, 06 Feb 2017 17:16:30 GMT

Thank you! I did start messing with the stanzas after it did not work initially. When I get home tonight, I'll try a reinstall and make sure that everything is set to asus.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

aaraneta_splunk — Mon, 27 Feb 2017 04:33:02 GMT

Hi @MonkeyK - Did amiracle's comment help provide a working solution to your question? If yes, please let me know so that I can convert it to an Answer to be accepted. That way others can easily find your question in case they have the same issue. Thanks.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Mon, 27 Feb 2017 20:00:31 GMT

Sorry, I lost track of trying the reinstall. I will do my best to try it when I get home tonight

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

nickhills — Tue, 28 Feb 2017 10:11:02 GMT

Your on the right track with netstat -p UDP if splunk is listening you should defiantly see an entry for it.

If that entry is missing, I wonder if splunk is failing to start the listener process?

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Sun, 05 Mar 2017 21:21:06 GMT

I think that you are right. I finally did the reinstall and just used the basic setup.
selected
hostname: RT-N66U (because ping -1 returned that)
sourcetype::asus

and I unchecked disable for udp 514

however I still see no data in the home monitor app and netstat -p UDP still shows nothing.

I will try disabling my Windows firewall temporarily to see if that is holding anything up.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Sun, 05 Mar 2017 21:37:22 GMT

OK. I disabled windows firewall on private Networks, still netstat -p UDP is empty.

So I went to my Splunk data inputs and disabled and re-enabled the UDP port 514. Still nothing on netstat -p UDP

Disabled windows firewall on public networks. Still nothing on netstat -p UDP
Disabled and reenabled port 514 in Splunk. Still nothing on netstat

Restarted Splunk with Windows firewall turned off. Still nothing on netstat.

Seems like there must be a step still missing

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

amiracle — Tue, 20 Jun 2017 03:44:01 GMT

Have you been able to get this working on your Windows box? I honestly have not tested this out on Windows since I don't have any Windows workstation to test this on in my lab. Let me know if there is anything I can test out from my end.

Thanks,
Kam

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Thu, 22 Jun 2017 04:26:36 GMT

Hey Kam. I kind of gave up. I just couldn't figure it out.

To be honest I dont even know where the problem is. Maybe I simply have not properly configured my router

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Tue, 27 Jun 2017 01:26:16 GMT

I gave it another shot. Uninstalled Splunk, reinstalled Splunk and Home Monitor.

Set my router to
Remote Log Server: 192.168.1.19 (my desktop, wifi)
Default message log level: info
Log only messages more urgent than: all

set windows firewall to allow UDP 514 inbound
configured Home Monitor, entered asus

verified my Splunk data inputs, I can see UDP 514 with a source type of asus enabled.

But no data in Splunk. So I fired up Wireshark (which I am not very good with) and put a filter on udp.port==514. This shows traffic from 192.169.1.1 to 192.168.1.19 with a Protocol of Syslog, but the messages are all DAEMON.INFO and then note DHCP. Not sure if home monitor is handling DHCP? But those should still get ingested as syslog, right?

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

amiracle — Tue, 27 Jun 2017 23:41:28 GMT

Yes, so the data being sent from your router should still show up in Splunk as Syslog. The question I have is if the Windows server is permitting Splunk to run and collect data on 514. I know it's usually an issue with Linux on root owned ports >1028.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Wed, 28 Jun 2017 02:33:37 GMT

I tried netstat -abn
found
splunkd on a whole lot of ports, but not 514. Instead svchost.exe was listening on 514
[svchost.exe]
UDP 0.0.0.0:514 :

Since Splunk says that UDP:514 is enabled, it could be that svchost is initiated by Splunk, but maybe not.
I'll try another question on this forum asking for help on how to verify that Splunk is able to collect data from 514.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Wed, 28 Jun 2017 02:41:23 GMT

Oh. getting closer. netstat -abno also gives me process ID.

[svchost.exe]
UDP 0.0.0.0:514 : 1820

looking that up in Task manager shows me that Process DI 1820 is splunkd.exe

I think that I still need to ask a separate question of why the logs don't get into Splunk

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

MonkeyK — Wed, 28 Jun 2017 20:12:21 GMT

Also pursuing this on snbforums. I have been informed that asus traffic logs are not exportable. I have seen elsewhere that this is an Asus/Merlin decision, so other firmwares may make traffic logs available.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

Jizbo — Sat, 17 Feb 2018 22:08:27 GMT

Did you ever get this figured out? I'm having the exact same problem.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

FrankVl — Mon, 19 Feb 2018 09:34:15 GMT

UDP packets should arrive at your windows box regardless of whether splunk is listening (if not, they will just get dropped). I'd suggest using a tool like wireshark to capture incoming network traffic, to confirm whether there is any incoming syslog traffic on UDP 514.

If so, the issue seems to be on Splunk side. If not, the issue is with your syslog source (or something in between your source and your splunk box).

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

Jizbo — Mon, 19 Feb 2018 12:20:37 GMT

Thanks, FrankVI. I downloaded Wireshark, filtered port UDP 514, turned on my Router VPN just to create some Syslog data and wireshark went crazy with tons of packets showing up on UDP 514 (on my WIn 10 Box which runs Splunk). So I know for certain the info is being sent from router to Splunk server box. The problem now is Splunk displays nothing. We can rule out the router sending the syslog...it is. Something is wrong with the Splunk settings on my Win 10 Box. I am really batting zero on this one.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

FrankVl — Mon, 19 Feb 2018 12:38:00 GMT

Any errors in splunkd.log about this input? Any sign of life in metrics.log for this input/sourcetype?
How are you searching for the data? Perhaps check for "All Time" in case some timestamping issue puts the events in the future or something.

Re: Home Monitor: How to configure the app to get syslog to Splunk on my home network?

Jizbo — Tue, 29 Sep 2020 18:05:16 GMT

Not sure if this helps. splunkd.log:
02-19-2018 08:13:32.629 -0500 WARN HttpListener - Connection from 127.0.0.1 didn't send us any data, disconnecting
02-19-2018 08:17:58.212 -0500 WARN DatabaseDirectoryManager - Failed getting size of path='C:\Program Files\Splunk\var\lib\splunk_internaldb\db\hot_v1_12\1519046180-1519046180-15382358171915657700.tsidx.lock': Access is denied.
02-19-2018 08:18:30.633 -0500 WARN HttpListener - Connection from 127.0.0.1 didn't send us any data, disconnecting
02-19-2018 08:18:30.633 -0500 WARN HttpListener - Connection from 127.0.0.1 didn't send us any data, disconnecting