topic Re: Sonicwall 4060 logs in Getting Data In

Sonicwall 4060 logs

kwandtke — Wed, 12 May 2010 01:02:53 GMT

I'd like to use the SYSLOG feature in the Sonicwall 4060 to send the logs to SPLUNK automatically .. currently I'm dumping the logs into a dir and having SPLUNK watch that .. it works but I'd like to get it to be less manual .. if anybody has done this and could give me some ideas ...

Re: Sonicwall 4060 logs

dwaddle — Thu, 13 May 2010 05:33:10 GMT

You should be able to configure your Sonicwall device to send events directly to Splunk acting as a syslog server. The first Google result for "Sonicwall syslog" came back to a Youtube video showing how to enable a Sonicwall to forward to an arbitrary syslog server.

http://www.youtube.com/watch?v=hIof-AV8akQ

There is also this link at Sonicwall's own site:

http://help.mysonicwall.com/sw/eng/705/ui2/23100/Log/Syslog.htm

That covers the Sonicwall side of the question. Now you'll need to configure Splunk to listen on a UDP port for syslog-style messages. That is well covered in the Splunk docs at

http://www.splunk.com/base/Documentation/latest/Admin/Monitornetworkports

Of course, two or three things to look out for in setting this up include:

Be sure no other syslog daemon/process is already listening on the port you are trying to use
Be sure Splunk has the necessary OS privileges to listen on the UDP port you specify (on Unix, you must be root to listen at less than port 1024 - the default for syslog is 514).
Be sure your host firewall (IPTables / Windows Defender / etc) allows the network traffic.

Re: Sonicwall 4060 logs

kwandtke — Thu, 13 May 2010 17:33:12 GMT

Thanks dwaddle,

Not sure what I messed up the first time as I had everything set .. I re-entered everything and the results are coming in .. fantastic

Re: Sonicwall 4060 logs

skender27 — Thu, 15 Oct 2015 08:57:43 GMT

Hi, what sourcetype should I put when I add 514 UDP port in Splunk: syslog?

Skender