topic Re: Dedicated Syslog collector or Splunk at port 514 in Getting Data In

Dedicated Syslog collector or Splunk at port 514

michael_lee — Sat, 16 Jan 2016 14:56:58 GMT

I read somewhere that it's not advisable to use Splunk at port 514 to collect syslog events but instead us a dedicated syslog server. If there is a change to Splunk configuration that needs a restart of the instance, it will not affect the syslog collection. In that case if Splunk is not collecting syslog, how can one read the syslog events from the syslog server into Splunk? Do we need to use a forwarder in this case?
thanks

Re: Dedicated Syslog collector or Splunk at port 514

a212830 — Sat, 16 Jan 2016 15:43:11 GMT

Correct - if you reading UDP syslog from a port using Splunk, then you run the risk of losing data when you restart Splunk. Most people send syslog to a syslog daemon (rsyslog or syslog-ng) and then write the files out to disk, and then read those files using a HFW. If you use this method (possibly with a load-balancer) then you reduce the risk of losing syslog messages.

Re: Dedicated Syslog collector or Splunk at port 514

javiergn — Sat, 16 Jan 2016 16:08:05 GMT

Hi,

We are planning to have two instances of Syslog-ng configured with the same virtual IP for failover purposes, writing Syslog traffic to the local disk. Then we run a local universal forwarder on each syslog server to read those log files. You don't really need a heavy forwarder for that.

Thanks,
J

Re: Dedicated Syslog collector or Splunk at port 514

dwaddle — Sat, 16 Jan 2016 16:45:08 GMT

One good reference to good practices here is George Starcher's blog post, http://www.georgestarcher.com/splunk-success-with-syslog/. While it is rsyslog specific, the same concepts apply to syslog-ng. Between the two, I would recommend syslog-ng if you have a choice as its a bit easier to grok the configuration of.

Re: Dedicated Syslog collector or Splunk at port 514

Richfez — Sat, 16 Jan 2016 17:07:17 GMT

Allow me a slightly different take, though still echoing the general principles.

In a smaller environment you can install and use syslog (either r-syslog or syslog-ng) on the same box where Splunk is installed. It's not ideal, but honestly the needs of syslog are small and as long as you log-rotate properly you shouldn't significant disk space requirements beyond what the data needs in Splunk.

If you do that, you do not need a forwarder and can simply have Splunk read the files directly from the local filesystem. Simple and straightforward.