topic Re: Windows UniversalForwarder not registering Syslog input in Getting Data In

Windows UniversalForwarder not registering Syslog input

pkarpushin — Tue, 29 Sep 2020 20:00:48 GMT

I am trying to make UniversalForwarder on Windows Server 2008 R2 Standard act as a syslog data receiver and forward this data to the Indexer.
It seems that Splunk on this Windows machine does not handle incoming syslog data.
Below is config:
C:\SplunkUniversalForwarder\bin>splunk.exe cmd btool inputs list udp
[udp]
_rcvbuf = 1572864
connection_host = ip
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = Splunk-gtw
index = default
[udp://514]
_rcvbuf = 1572864
connection_host = ip
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = Splunk-gtw
index = default

C:\SplunkUniversalForwarder\bin>netstat -apb UDP
Active Connections
Proto Local Address Foreign Address State
UDP 0.0.0.0:123 *:
W32Time
[svchost.exe]
UDP 0.0.0.0:514 :
[splunkd.exe]*

I see data in Wireshark capture, but metrics.log shows this:
6-15-2018 13:23:12.395 +0300 INFO Metrics - group=queue, name=udp_queue, max_size_kb=500, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0
06-15-2018 13:23:12.395 +0300 INFO Metrics - group=udpin_connections, *:514, sourcePort=514, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00

Please advise what may be the source of the trouble

Re: Windows UniversalForwarder not registering Syslog input

splkmika1 — Fri, 20 Jul 2018 05:49:37 GMT

Hi, did you ever resolve this issue? I am observing the same issue in my network at the moment.

Re: Windows UniversalForwarder not registering Syslog input

lmaclean — Fri, 20 Jul 2018 10:33:13 GMT

Is Splunk running as SYSTEM or as a user and if as a user does it have the required permissions to listen to ports on Windows?

Have you checked splunkd.log when it starts up for "TcpInput" type components and if there are any issues it is reporting?

Re: Windows UniversalForwarder not registering Syslog input

pkarpushin — Mon, 23 Jul 2018 07:09:45 GMT

No, unfortunately. I had to give up listening 514 udp on my Windows machine, and started monitoring log files on a remote machine instead.

Re: Windows UniversalForwarder not registering Syslog input

splkmika1 — Wed, 25 Jul 2018 00:12:58 GMT

no worries. Thanks. Yeah I moved over to monitoring files on a separate syslog server as well.

Re: Windows UniversalForwarder not registering Syslog input

splkmika1 — Wed, 25 Jul 2018 00:16:09 GMT

tried running it as the default Windows LocalSystem account, so the permissions I think should be ok. I could also see the Universal Forwarder exe listening on udp 514 with a netstat -a -b.

I've given up on this and just gone with using an external syslog server with a Universal Forwarder installed.
Thanks for your response.