topic VIP Setup on Heavy Forwarder in Getting Data In

VIP Setup on Heavy Forwarder

SamHelp — Fri, 14 Jun 2024 06:42:56 GMT

There are two heavy forwarders at our site. The current setup is that there is a VIP defined for client server access.

Here is example for IP definitions:

heavy forwarder 1 [10.1.2.11]

heavy forwarder 2 [10.1.2.12]

VIP [10.1.2.10]

When client server wants to forward monitoring data to splunk, it just pointed to the VIP, 10.1.2.10.

However, I could not find the IP [10.1.2.10] on client server and both heavy forwarders by issuing ifconfig OS command.

How was the VIP defined? There is no load balancer in front of both heavy forwarders.

Re: VIP Setup on Heavy Forwarder

SamHelp — Fri, 14 Jun 2024 04:15:22 GMT

I issued the following command on client server, heading for VIP:

$ ssh splunk@10.1.2.10

#######################################
### pspfwd01 ###
#######################################

******************************************************************
WARNING: To protect the system from unauthorized use and to ensure
that the system is functioning properly, activities on this system
are monitored and recorded and subject to audit. Use of this
system is expressed consent to such monitoring and recording. Any
unauthorized access or use of this Automated Information System is
prohibited and could be subject to criminal and civil penalties.
******************************************************************

splunk@10.1.2.10's password:

Heavy forwarder 1 [pspfwd01 -- 10.1.2.11] replied...

Re: VIP Setup on Heavy Forwarder

gcusello — Fri, 14 Jun 2024 13:46:30 GMT

Hi @SamHelp ,

you don't have any evidence of the LB configuration on the HFs: the clients point to the VIP and the Load Balancer distribute load between the HFs.

Rememeber to configure the LB in transparent Mode to avoid to have as host the hostname of the LB.

I suppose that you're speaking of syslogs or HEC, not Un iversal Forwarders that don't need the LB.

Ciao.

Giuseppe