topic Re: Configure an intermediate forwarder in Getting Data In

Configure an intermediate forwarder

Tumarbayev — Mon, 27 Nov 2023 10:12:26 GMT

Hello team.
My task is that universal forwarder should collect the events from other hosts and then do realy to main server. How can i do it?

Re: Configure an intermediate forwarder

gcusello — Mon, 27 Nov 2023 10:30:23 GMT

Hi @Tumarbayev,

let me understand:

are you speaking of an intermediate Forwarder that colelcts logs from other Universal Forwarder and sends them to indexers, is it correct?

Are you speaking of an Heavy or an Universal Forwarder?

Anyway, youcan use as concentrator, both a Universal or an Heavy Forwarder, even if I usually use an HF.

At first you have to configure your HF Concentrator to forwarder logs to the Indexers.

Then you have to enable, on HF, receiving on a port (default 9997).

At least, you have to configure your target UFs to send their logs to the HF using the define port (9997).

If you have HA requirements, it's better to have two HFs to avoid Single Points of Failure.

Ciao.

Giuseppe

Re: Configure an intermediate forwarder

Tumarbayev — Mon, 27 Nov 2023 10:45:06 GMT

you mean i should configure the Universal forwarder on receiving mode and then on the sender server configure output to configured forwarder?

Re: Configure an intermediate forwarder

gcusello — Mon, 27 Nov 2023 10:50:04 GMT

Hi @Tumarbayev,

yes, you have to configure the Intermediate Forwarder bot as receiver and forwarder.

If you use an HF you can do all by GUI, if you use a UF, you have to condifure outputs.conf and inputs.conf; if you use a UF, remember to configure in limits.conf maxKBpm=0 otherwise you'll have queues issues.

Then, in the target UFs, you have to configure outputs.conf to point to the intermediate Forwarder.

Ciao.

Giuseppe

Re: Configure an intermediate forwarder

Tumarbayev — Mon, 27 Nov 2023 11:00:27 GMT

Last question. How can i configure the UF as a receiver on 9997?