topic Re: Linux Syslogd Config in Getting Data In

Linux Syslogd Config

balcv — Fri, 04 Oct 2013 00:18:41 GMT

This is not a splunk specific question however it is very related and involves config of syslog on a linux host that will NOT send to my splunk server.

I have a linux server running syslogd ver 1.4.1 and I have added a line to the syslog.conf file that has . @192.168.1.1:64514
(I use port 64514 due to a port conflict but it works). Keep in mind I have this working on other hosts.

When I trigger an event I get nothing on Splunk. If I run a packet capture on the host I do not even see the packets attempting to leave. However, if I remove the port number (64514), I do see traffic leaving on port 514.

Can anyone help with this problem?

Re: Linux Syslogd Config

lukejadamec — Fri, 04 Oct 2013 00:29:21 GMT

Did you check netstat to see if the port you are trying to use is already in use?

Re: Linux Syslogd Config

balcv — Fri, 04 Oct 2013 00:40:52 GMT

I have now checked and no, the port is not being used.

Re: Linux Syslogd Config

jkerai — Fri, 04 Oct 2013 02:05:33 GMT

Can you check if you are able to connect to the ip port? You can do 'telnet 192.168.1.1 64514' or 'echo "test" | nc 192.168.1.1 64154'.

Re: Linux Syslogd Config

balcv — Fri, 04 Oct 2013 02:23:46 GMT

Yes I am able to get a connection to the ip:port combination.

Re: Linux Syslogd Config

jspears — Sun, 06 Oct 2013 18:35:12 GMT

If this is close to the man page for your syslogd, it may not have support for logging to an alternate port: http://linux.die.net/man/8/syslogd

I can recommend rsyslog as a very flexible alternative.

Re: Linux Syslogd Config

balcv — Sun, 06 Oct 2013 22:02:05 GMT

Thanks for that. I had "suspected" this was the case but could not see it documented but it does explain why it does not work. I'll go with rsyslog.

Thanks

Re: Linux Syslogd Config

aravm8 — Fri, 01 Nov 2013 16:35:16 GMT

Hi Frnd,

See here you have just mentioned the ipaddress of the other host in the syslog.conf file in which where your all logs that listening to the port 514 to be forwarded tell me that have you installed and configured the splunk on the 192.168.1.1 server?.

inform me whether above my comments gave you an idea.

Regards,
Aravinth