Cisco ASA 5510 - cannot get data

renatac — Fri, 20 Jul 2012 14:18:31 GMT

Hi,
I´ve installed Splunk App for Cisco ASA version 0.9.6 downloaded today, and cannot see any data.
Cisco is generating syslog and I´ve configured source as syslog over UDP but nothing is shown on app page.
Do you have a conf guide or some useful info that you can send?
Regards,
renatac

Re: Cisco ASA 5510 - cannot get data

dwaddle — Fri, 20 Jul 2012 14:44:45 GMT

For starters, are you sure the UDP events are making it into Splunk? I would probably start out with checking some of the following:

What port# do you have Splunk set to listen on? If it's < 1024 Splunk needs to be running as root. Check output of (on linux) netstat -anup to make sure it is listening. You may have another process (rsyslog/syslog-ng/etc) already listening on the default UDP syslog port.
Use tcpdump to make sure the UDP packets from the ASA are arriving at the Splunk server, on the port you expect them on.
If Splunk is listening on the right port and the packets are arriving at the splunk host, is the local host's firewall blocking the udp events?
Run a realtime search on "*" and see if you can see these events showing up, perhaps under an unexpected sourcetype

If Splunk is definitely getting the events, then there may be other problems. But you need to make sure the data is getting there first.

topic Cisco ASA 5510 - cannot get data in Getting Data In

Cisco ASA 5510 - cannot get data

Re: Cisco ASA 5510 - cannot get data