topic Re: Ingesting Logs from Cisco Routing and Switching Gear in Getting Data In

Ingesting Logs from Cisco Routing and Switching Gear

603_Dan — Tue, 28 Sep 2021 16:47:22 GMT

Hi,

I've been asked to add inputs to my organization's Splunk Enterprise from Cisco Routing and Switching Gear. I remember reading in the documentation that Splunk's recommended best practice in is to use a syslog-collector running a UF or HF between the Routers/Switches and Indexers to keep the Indexers from becoming flooded with incoming traffic.

I had thought to do this with a Linux machine running a UF or HF and ingesting Router/Switch log traffic before forwarding the traffic along to Splunk Enterprise but I've been told an additional machine, even a virtual one, is a no go. I don't believe a Windows syslog-collector would work either as Windows can't do this with native tools, and I've been told 3rd party software is also a no-go.

Could anyone recommend a solution that doesn't use a Linux syslog-collector, a Windows syslog-collector running 3rd party software, that meets Splunk's best practice suggestions?

Thank you,

603_Dan

Re: Ingesting Logs from Cisco Routing and Switching Gear

PickleRick — Tue, 28 Sep 2021 17:06:18 GMT

Sorry, but if someone wants to receive syslog events (most probably UDP ones) and isn't prepare to create additional component needed to process this trafic... well, then we can't do much.

Yes, splunk can listen on TCP or UDP port for incoming syslog events but it's not a solution advised for production use. Furthermore, I assume that your company is running an all-in-one installation. Processing all input data along with all the other splunk server activity is not a very good idea (again - especially if you're going to be dealing with UDP events which are prone to getting lost).

So in short - your company is trying to make you move a 5 ton steel beam giving you only a Mazda MX-5. Sorry, it won't fly however strongly you wish for it.

Re: Ingesting Logs from Cisco Routing and Switching Gear

603_Dan — Tue, 28 Sep 2021 19:24:09 GMT

> So in short - your company is trying to make you move a 5 ton steel beam giving you only a Mazda MX-5. Sorry, it won't fly however strongly you wish for it.

Thank you for saying that. It doesn't help but it DOES make me feel better. 🙂