topic Re: how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux? in Deployment Architecture

how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux?

dsepulveda — Thu, 31 May 2012 21:06:48 GMT

Hello,

My name is Daniel, i am evaluating Splunk to be used as a part of a SOC but i haven't been able to configure linux boxes (Debian) to send their log information to my splunk server, i've already set up a port to listen to on the server side, but haven't been able to make the clients send their logs in, can you please help me?

Re: how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux?

yannK — Thu, 31 May 2012 21:32:42 GMT

You have 3 methods :

Use syslog, and configure your linux boxes to send their syslog events to the indexer on the UDP port you opened. Variation : using rsyslog or syslog-ng to use TCP instead of UDP, and use another port than default 514.
On the indexer : enable input on UDP or TCP on the port used
Remark : on unix box, only root processes can listen to the port under 1024,
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Data/Monitornetworkports
please read your syslog service configuration to specify the destination server/port

Install an UniversalForwarder on each boxes to monitor the log files (/var/log/ folder usually) and forward to the indexer on the port splunktcp
On the indexer : enable receiving in the manager.
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/Aboutforwardingandreceivingdata
and http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories

A mixed configuration is to setup a syslog server that is receiving all the syslog event, then write to disk in files, and have splunk monitor those files.

Re: how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux?

mendesjo — Fri, 26 Feb 2016 20:05:21 GMT

Please, don't take it the wrong way, but how does that information help in setting up a unix server TO SEND syslog data over to a splunk box?

Re: how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux?

rdimri_splunk — Fri, 26 Feb 2016 20:22:33 GMT

@mendesjo ,the information provided about what you can do to send log information is the key. The actual process of setting up syslog to send data should be trivial.

Re: how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux?

mendesjo — Fri, 26 Feb 2016 20:24:07 GMT

Probably.. if you know unix. But since we don't that's why he's asking.