topic Re: syslog logs are missing in Deployment Architecture

syslog logs are missing

msplunk33 — Sat, 17 Oct 2020 20:35:13 GMT

I am using linux rsyslog server to capture syslog from Cisco ASA firewall and send to the splunk using the universal forwarder. I have two syslog servers behind a load balancer for redundancy. The problem I am facing is I am missing a lost of logs in syslog server. I know syslog use UDP traffic which is unreliable. Is there any way I can troubleshoot this issue. Is there any other better method l can collect this syslog. I tried to send syslog to to splunk directly still I can see missing logs.

Re: syslog logs are missing

inventsekar — Sat, 17 Oct 2020 21:25:28 GMT

Hi @msplunk33 do you use HF? do you use syslog-ng?
let the syslog servers send logs to a remote system and on that remote system, you can install UF/HF and collect the logs.. which is very efficient than UDP(as per my understanding).

https://wiki.splunk.com/Community:Best_Practice_For_Configuring_Syslog_Input

https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-connect-for-syslog-turnkey-and-scalable-syslog-gdi.html

please check this Splunk Conf document:

https://conf.splunk.com/files/2017/slides/the-critical-syslog-tricks-that-no-one-seems-to-know-about.pdf

Re: syslog logs are missing

msplunk33 — Sun, 18 Oct 2020 01:40:28 GMT

@inventsekar

yes this is a good approach. I have a question regarding the syslog. I am not very knowledgeable in syslog. Just want to clarify can we configure the network end device ( like CISCO ASA, Cisco switches etc) to send syslog into TCP port rather than UDp. As I know universally syslog use UDP port.

Re: syslog logs are missing

to4kawa — Sun, 18 Oct 2020 01:54:03 GMT

https://qiita.com/odorusatoshi/items/5a703b9befc253ab7deb japanese

index=_internal host=your_syslog_host
check this result

Re: syslog logs are missing

isoutamo — Sun, 18 Oct 2020 13:48:28 GMT

In now a days this is doable in the most network equipments, unfortunately not in all. You must check it from you device’s manuals.
Still you should set up a separate syslog server to receive those events and then send/read those with/from it. Otherwise you will be lost event time by time (e.g. restarting HF/indexer).
r. Ismo