https://community.splunk.com/t5/Getting-Data-In/Syslog/m-p/660442#M111664 <P>I have been tasked with cleaning up the catchall directory in the syslog directory of our Heavy Forwarders. The path is /var/syslog/catchall/. I plan on<SPAN>&nbsp;grouping servers/directories based on the kind of logs being received.&nbsp;</SPAN>I just wanted to ask what kind of logs are usually expected to end up in this directory?</P> Wed, 11 Oct 2023 19:08:26 GMT SakAch 2023-10-11T19:08:26Z https://community.splunk.com/t5/Getting-Data-In/Syslog/m-p/660442#M111664 <P>I have been tasked with cleaning up the catchall directory in the syslog directory of our Heavy Forwarders. The path is /var/syslog/catchall/. I plan on<SPAN>&nbsp;grouping servers/directories based on the kind of logs being received.&nbsp;</SPAN>I just wanted to ask what kind of logs are usually expected to end up in this directory?</P> Wed, 11 Oct 2023 19:08:26 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog/m-p/660442#M111664 SakAch 2023-10-11T19:08:26Z https://community.splunk.com/t5/Getting-Data-In/Syslog/m-p/660447#M111665 <P>Ideally, the catchall directory would be empty because the syslog server was configured to have a separate directory for each type of log data coming it.&nbsp; The catchall directory is there for when someone stands up a new service that sends syslog data.&nbsp; That unexpected kind of log would land in the catchall directory and, hopefully, alert the syslog admin to the need for additional configuration.</P> Wed, 11 Oct 2023 19:23:28 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog/m-p/660447#M111665 richgalloway 2023-10-11T19:23:28Z