topic Re: Query to forward logs from UF to Syslog-ng using either BSD/IETF syslog format in Getting Data In

Is it possible to forward logs from UF to Syslog-ng using either BSD/IETF syslog format?

mohdmikhael — Tue, 29 Nov 2022 14:03:52 GMT

Hi,

I was posed a query from my customer. Is it possible to forward syslog from UF to Syslog-ng using the BSD/IETF syslog format? If so, how would one go about implementing it?

Thank you in advance for any information provided.

Regards,

Mikhael

Re: Query to forward logs from UF to Syslog-ng using either BSD/IETF syslog format

isoutamo — Tue, 29 Nov 2022 09:42:02 GMT

Yes it's possible, at least on HF side, but why you don't send all to syslog-ng and then read those by UF from syslog-ng server? That is much better approach than use splunk to deliver syslog.

If you still want to do it by splunk, there are lot of examples on community and docs.splunk.com e..g

https://community.splunk.com/t5/Getting-Data-In/Forwarding-data-from-Heavy-forwarder-to-syslog-server/m-p/473916

r. Ismo

Re: Query to forward logs from UF to Syslog-ng using either BSD/IETF syslog format

PickleRick — Tue, 29 Nov 2022 10:43:37 GMT

The question was about UF. And on UF it's not possible. Quoting from outputs.conf spec:

# The syslog output processor is not available for universal or light
# forwarders.

Anyway, I suppose it's a case of replacing one solution with another or implementing two different solutions for two different purposes (like Splunk for security and some syslog collector for ops). I'd probably also suggest doing the syslog part first and pass the events to the Splunk layer (either by saving to files and ingesting the files with UF or by pushing them directly to HEC from the syslog server, bypassing UF completely).