topic Re: Splunk and Cisco Firepower Audit Logs in Getting Data In

Splunk and Cisco Firepower Audit Logs

b17gunnr — Mon, 07 Apr 2025 15:53:16 GMT

Hello folks,

My organization is struggling with ingesting the Cisco Firepower audit (sys)logs into Splunk, we've been able to successfully ingest all the other sources. With the Firepowers only offering up 514udp which is unavailable according to Splunk, or a HEC configuration without tokens so Splunk is (would?) drop the events our option appear limited. Has anyone else come across this issue and solved it?

Re: Splunk and Cisco Firepower Audit Logs

livehybrid — Mon, 07 Apr 2025 16:02:09 GMT

Hi @b17gunnr

The error "UDP port 514 is not available" typically means that Splunk is not able to listen to the port, which is typically for 1 of 2 reasons:

Another process is already listening to the port
Confirm that nothing is already using this port, this process will vary between different OS.
Splunk does not have permissions to listen to port 514.
To listen to ports <1024 the Splunk process may require additional permissions (CAP_NET_BIND_SERVICE) and/or could be affected by AppArmor / SELinux. This will also vary depending on OS.

For more information check out https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

Also, theres a previous Splunk answer which might help at https://community.splunk.com/t5/Getting-Data-In/how-to-listen-to-port-UDP-514-when-splunk-is-not-root/m-p/108169

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk and Cisco Firepower Audit Logs

PickleRick — Mon, 07 Apr 2025 22:27:26 GMT

Also remember that while Splunk can listen for syslogs this is not a recommended setup. It's relatively ok for a small lab deployment but in production you'd rather want to go for a separate syslog daemon either writing to local files for pick up by UF or sending to HEC input.

Re: Splunk and Cisco Firepower Audit Logs

b17gunnr — Fri, 11 Apr 2025 11:21:03 GMT

Unfortunately neither of these were the cause. In the end I believe we're going to set up an intermediate VM with a UF to catch the logs from the Firepowers on udp514. Clunky but it appears to be the only option. I appreciate the help.