topic Re: How to send syslog using rsyslog over TCP encrypted with TLS? in Getting Data In

How to send syslog using rsyslog over TCP encrypted with TLS?

im_bharath — Mon, 10 Apr 2023 16:54:48 GMT

Hello All,

Currently a certain application is sending the data to splunk via syslog method(rsyslog) using TCP, so now the application team want to try and send the data using the syslog (rsyslog) over TCP with TLS encryption,

Can any one please help me how this can be achieved, and it would be really awesome if anybody can provide leads on any splunk documentation or links available for reference.

Thanks.

Re: How to send syslog using rsyslog over TCP encrypted with TLS?

yeahnah — Mon, 10 Apr 2023 23:12:28 GMT

Hi @im_bharath

There's some information here:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Configure_an_encrypted_TCP_network_input_over_SSL

Basically, configure a tcp-ssl stanza in the inputs.conf file on the receiving Splunk server:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#TCP:_Transport_Control_Protocol_.28TCP.29_network_inputs

You'll need to put the public SSL/TLS cert for the rsyslog server on the Splunk receiver and configure these too (ensure the certs are readable to the Splunk process). It's likely you'll need to configured the cert parameters under your tcp-ssl stanza (not the global SSL stanza) for this single TCP TLS port. Ensure the Splunk receiver is restarted once configured too.

Once configured right you should be able to test the Splunk receiving port is configured and listening for incoming encrypted data OK using openssl, e.g.

On a *NIX server

splunk$ echo | openssl s_client -connect <splunk receiver>:<port> 2>/dev/null | openssl x509 -noout -subject -dates

Hope this helps to get you started.

Re: How to send syslog using rsyslog over TCP encrypted with TLS?

Silah — Wed, 31 Jul 2024 11:28:55 GMT

Hello

I have been trying to send logs to a Splunk TCP input using rsyslog but I cannot make it work. I know this is not related to your question but is there any way you can share how you did it ?

Re: How to send syslog using rsyslog over TCP encrypted with TLS?

PickleRick — Wed, 31 Jul 2024 12:08:45 GMT

If you are already receiving syslog on your rsyslog, it's better to send it to splunk using HEC input on Splunk's side and omhttp action on rsyslog's side.