topic Re: Secure transport of log files to our Splunk Server in Getting Data In

Secure transport of log files to our Splunk Server

sipapress2go — Fri, 07 May 2010 14:39:12 GMT

How do I secure my log file stream from our primary server to our dedicated Splunk server? Are there any secured layers I can use for the TCP transport?

I have tried to do it with an SSH-tunnel, but when the tunnel breaks down, the next message going through the tunnel is lost.

What do you do?

Re: Secure transport of log files to our Splunk Server

CerielTjuh — Fri, 07 May 2010 16:17:06 GMT

Im not sure if this is what you mean but:

If the primary server is a windows server you could use a splunk forwarder with ssl connection, this will ensure data transport and data integrity. (does not require a extra license, forwarder licenses are free)

If the primary server is not a windows server, try a secure FTP connection to transfer the files to the splunk server.

The first method is approved by our SAS70 compliancy auditors, so should work for you as well 🙂

Re: Secure transport of log files to our Splunk Server

sipapress2go — Fri, 07 May 2010 16:28:06 GMT

Both servers run Debian and also I want to be able to follow progress of the primary server in close to realtime (with a delay of max 10 sec.).

Perhaps rsyslog is something I should look into?

Re: Secure transport of log files to our Splunk Server

CerielTjuh — Fri, 07 May 2010 18:58:52 GMT

Maybe next gen syslog.

Syslog but over a TCP connection.

http://www.debianhelp.co.uk/syslog-ng.htm

Re: Secure transport of log files to our Splunk Server

dwaddle — Fri, 07 May 2010 22:09:45 GMT

Use a Splunk forwarder, configured in SSL mode. This is considered the best practice.

Re: Secure transport of log files to our Splunk Server

matt — Fri, 07 May 2010 23:47:10 GMT

Splunk forwarders can encrypt their communication with the indexer using SSL, this can also be used to authenticate the forwarders which will prevent unauthorized forwarders from polluting your index. Documentation on how to configure encryption and authentication of forwarders using SSL can be found here

Re: Secure transport of log files to our Splunk Server

gkanapathy — Fri, 07 May 2010 23:55:07 GMT

the splunk forwarder with ssl will work between any two platforms on which splunk runs, which includes most unixes, linux, and windows. rsyslog is fine too, but you're more on your own with respect to setting up matching certificates, etc.

Re: Secure transport of log files to our Splunk Server

CerielTjuh — Mon, 10 May 2010 13:43:52 GMT

true gkanapathy 😉