topic Re: Unable to forward syslogs coming in from UDP:514 in Getting Data In

Unable to forward syslogs coming in from UDP:514

xrtan — Tue, 19 Jan 2016 07:50:09 GMT

Here is my setup on my Heavy Forwarder

inputs.conf

[udp://:514]
sourcetype = syslog
connection_host = ip
disabled = 0
[tcp://:514]
sourcetype = syslog
connection_host = ip
disabled = 0

outputs.conf

[tcpout]
defaultGroup = indexers
[tcpout:indexers]
server = < ip-address >:9997, < ip-address >:9997

However, on my indexers, I'm only able to see source tcp:514. My UDP syslogs are not being indexed.

Any idea where went wrong?

EDIT (resolved):
Just to update, configured my props.conf and solve the issue

Old configuration:
[host::10.1.1.1]
TRANSFORMS-change = change

Corrected configuration:
[source::udp:514]
TRANSFORMS-change = change

Hope this might be useful to anyone who is trying to achieve something similar to what i'm trying

Re: Unable to forward syslogs coming in from UDP:514

alemarzu — Tue, 19 Jan 2016 13:09:43 GMT

Xrtan,

You did not specified index on each input stanza. Did you enable receiving port 9997 on the Indexer ?

Re: Unable to forward syslogs coming in from UDP:514

xrtan — Wed, 20 Jan 2016 00:06:37 GMT

Hi alemarzu, the event are going into default index main. 9997 is enabled on indexer too.
The indexer is indexing events from tcp:514 but not udp:514.

Re: Unable to forward syslogs coming in from UDP:514

alemarzu — Wed, 20 Jan 2016 20:23:05 GMT

Did you tried to search those events directly on the Heavy Forwarder first ? (udp:514)
What about rules on your firewall, did you check them ?

Re: Unable to forward syslogs coming in from UDP:514

xrtan — Fri, 22 Jan 2016 08:17:41 GMT

if i were to use indexandForward it will be able to index, however not able to send out.
Firewall has been turned off. Anyhow, i've figured out what went wrong. Thanks for the help, cheers.

Re: Unable to forward syslogs coming in from UDP:514

alemarzu — Fri, 22 Jan 2016 12:49:07 GMT

Great xrtan, do you mind sharing the answers, it may help other members.