topic Re: Splunk HF Stops Receiving Fortigate WAF Logs via Syslog Intermittently in Getting Data In

Splunk HF Stops Receiving Fortigate WAF Logs via Syslog Intermittently

refahiati — Wed, 30 Oct 2024 05:27:54 GMT

Hello everyone,

I'm currently collecting logs from a Fortigate WAF using Syslog, but I've encountered an issue where, after running smoothly for a while, the Splunk Heavy Forwarder (HF) suddenly stops receiving and forwarding the logs. The only way to resolve this is by restarting the HF, after which everything works fine again, but the problem eventually recurs.

Could anyone advise on:

Possible causes for this intermittent log collection issue
Any specific configurations to keep the Syslog input stable
Troubleshooting steps or recommended best practices to prevent having to restart the HF frequently
Any insights or similar experiences would be much appreciated!

Thank you!

Re: Splunk HF Stops Receiving Fortigate WAF Logs via Syslog Intermittently

isoutamo — Wed, 18 Dec 2024 20:54:58 GMT

Have you configured tcp input in HF or are you using separate syslog (like rsyslog or syslog-ng) to receiving those? If you are using HF then just add real syslog server and collect logs from local files.

Re: Splunk HF Stops Receiving Fortigate WAF Logs via Syslog Intermittently

kiran_panchavat — Thu, 19 Dec 2024 10:44:00 GMT

@refahiati Are you experiencing high resource usage on the Splunk Heavy Forwarder? If so, I suggest configuring syslog-ng or rsyslog on the Heavy Forwarder to collect logs and store them in a separate directory. You can then monitor that directory to forward the events to Splunk indexers. Additionally, review the queues in the metrics.log file for any potential issues.