topic Re: Decode Logs coming from Syslog (SSL) in Getting Data In

Decode Logs coming from Syslog (SSL)

elli_i — Wed, 06 Sep 2017 14:37:18 GMT

Hi,
i am trying to send encrypted logs from Syslog to Splunk. To decrypt them i changed the splunk/etc/system/local/inputs.conf file like so:
[tcp-ssl:5140]
[SSL]
serverCert = path.pem
sslPassword = password

I already get the encrypted Logs but the decryption doesnt work.
Can you help me?

Re: Decode Logs coming from Syslog (SSL)

jkat54 — Wed, 06 Sep 2017 16:24:59 GMT

The tcp-ssl stanza just enables ssl on the connection from the syslog server to the splunk server. It's not going to handle any decryption of the underlying data.

Re: Decode Logs coming from Syslog (SSL)

elli_i — Thu, 07 Sep 2017 06:02:17 GMT

Okay, thanks! And what handles the decryption? I thought by sharing the certificate, with the ssl stanza, decryption is enabled. Or do i have to add a personal script? If so, is there a possibility, to just point splunk to the script, and splunk handles it?

Re: Decode Logs coming from Syslog (SSL)

esix_splunk — Thu, 07 Sep 2017 06:35:51 GMT

Splunk wont be able to decrypt this. You're going to want to use rsyslog/syslog-ng to do this, and after the files are decrypted and written to disk, use the UF to read the files.

Re: Decode Logs coming from Syslog (SSL)

crendon_splunk — Tue, 19 May 2020 21:28:28 GMT

I know has been long time, were you able to decryp the logs at the end?

Re: Decode Logs coming from Syslog (SSL)

saravanan90 — Tue, 16 Feb 2021 05:23:04 GMT

Hi @esix_splunk,

Is the above state still true with newer version of Splunk. Can Splunk decrypt the encrypted data coming from external?

Re: Decode Logs coming from Syslog (SSL)

esix_splunk — Tue, 16 Feb 2021 05:31:41 GMT

Same still holds true, you cannot send SSL traffic to a Splunk-SSLTCP input and hope Splunk can decrypt it.

Splunk TCP/SSL is for Splunk2Splunk(S2S) over SSL.

Re: Decode Logs coming from Syslog (SSL)

saravanan90 — Tue, 16 Feb 2021 05:34:30 GMT

Thanks a lot for your quick help @esix_splunk.