topic Re: rsyslog vs. Splunk Forwarder in Getting Data In

rsyslog vs. Splunk Forwarder

csclement — Tue, 14 May 2013 00:09:03 GMT

Hi,

I am wondering what are the pros and cons of the following two logging setups:

All hosts run rsyslog and forward logs to a central server. Install Splunk Forwarder only on the central server and forward logs to Splunk server.
Install Splunk Forward on every host and have logs forward to the Splunk server.

Would appreciate if anyone can share his/her experience. Thanks.

Re: rsyslog vs. Splunk Forwarder

yannK — Tue, 14 May 2013 00:46:12 GMT

It depends for which logs. I prefer the forwarder for it's flexibility, but syslog has a lower footprint.

for syslog logs, with all the same format, you can use the syslog aggregator.
for specific logs with specific formats and applications, the splunk forwarder allow you to specify the sourcetype.

syslog over udp => not resilient to network issues.
splunk forwarder => SSL and caching.

deployment of a central syslog => easy
deploy and maintain many forwarder => requires tools or deployment server

Re: rsyslog vs. Splunk Forwarder

kristian_kolb — Tue, 14 May 2013 05:23:12 GMT

And the forwarder can do WinEventLogs far nicer, at least compared to snare. In fact, if there are multi-line log messages, I'd say that's a sign to go with a forwarder.

Re: rsyslog vs. Splunk Forwarder

miteshvohra — Tue, 14 May 2013 08:57:10 GMT

Additionally, you can throttle bandwidth for sending logs over WAN network using Forwarder which is not otherwise possible.