topic Re: Questions about CentOS rsyslog and Splunk configuration in Getting Data In

Questions about CentOS rsyslog and Splunk configuration

InteractM — Thu, 05 Sep 2013 15:54:34 GMT

I have a dedicated syslog server running on CentOS6 (rsyslog) which gathers all logs from other servers/devices (stored in a database).

My questions are:
1. Can I install Splunk on same server?
2. What do I need to do to have Splunk as syslog analyzer (and to keep rsyslog as syslog server)?

Thanks

Re: Questions about CentOS rsyslog and Splunk configuration

jtrucks — Thu, 05 Sep 2013 19:34:50 GMT

You'll need to have rsyslog send a copy to Splunk and a copy into the database. This isn't hard to do with rsyslog.

You could send directly to a Splunk TCP input using:

*.* @@centralserver.example.net

in addition to your database configuration.

Alternatively, have the files written to disk and to your database, and then just have Splunk read those log files.

Splunk automatically parses syslog formatted logs, so you can just send it directly or have it read the files directly.

That's it. 🙂

Re: Questions about CentOS rsyslog and Splunk configuration

InteractM — Thu, 05 Sep 2013 21:16:53 GMT

@@centralserver.example.net is this a location of the server where is Splunk located? Is this not going to loop because is this on same server or it will be parallel connection?

Current rsyslog config connection looks like:
*.* :ommysql:127.0.0.1,rsysdb,user,pass

Re: Questions about CentOS rsyslog and Splunk configuration

InteractM — Mon, 09 Sep 2013 19:49:51 GMT

Well, I have added

*.* @@localhost

to the rsyslog config and it looks like is not gathering any data (wrong syntax?) neither Syslog seeing anything from syslog (added TCP listening on port 514)

Any clue?

Thanks

Re: Questions about CentOS rsyslog and Splunk configuration

InteractM — Mon, 09 Sep 2013 20:11:25 GMT

OK, got it fixed. There were two issues:

1) to use local IP instead a domain 'localhot'
2) Line *.* @@127.0.0.1 must be added after a line with saving to the DB (as a primary logs storage)