topic How to send journal logs to splunk ? in Getting Data In

How to send journal logs to splunk ?

meenakande — Wed, 30 Sep 2020 04:56:11 GMT

How do i send journal logs to splunk??

journalctl -u servicename

Here journal logs are raw logs. Will splunk read raw logs ?

Configuration setup on my bos-server1
root@bos-server1#/opt/splunkforwarder/etc/apps/linux_auth/default# cat inputs.conf
[monitor:///var/log/auth*.log]
sourcetype = linux_authlog
index = linux_log
disabled = false

[monitor:///var/log/syslog]
sourcetype = linux_syslog
index = linux_log
disabled = false

Below journal logs location:

root@bos-server1:/run/log/journal/112824edd9f56398bab569035733662e# pwd
/run/log/journal/112824edd9f56398bab569035733662e
root@bos-rndapp02:/run/log/journal/112824edd9f56398bab569035733662e# ls -al
total 344472
drwxr-s---+ 2 root systemd-journal 220 Jan 21 13:40 .
drwxr-sr-x 3 root systemd-journal 60 Sep 21 08:06 ..
-rw-r-----+ 1 root systemd-journal 41943040 Jan 14 02:57 system@dcf33424670b4269a8a8b1b6b5b86200-000000000043823d-00059bfe728bd765.journal
-rw-r-----+ 1 root systemd-journal 42151936 Jan 15 01:07 system@dcf33424670b4269a8a8b1b6b5b86200-0000000000443355-00059c14f222a797.journal

Re: How to send journal logs to splunk ?

richgalloway — Sat, 11 Apr 2020 12:32:04 GMT

When you restart Splunk (or the forwarder if that is what you are using) after changing the inputs.conf file, data should be sent to Splunk. What do you get when you search index=linux_log?

Re: How to send journal logs to splunk ?

PavelP — Sun, 12 Apr 2020 02:43:40 GMT

Hello @meenakande ,

depending on OS, the journal logs usually duplicated in various /var/log/*log so just by monitoring them with monitor stanza as you mentioned should work in most cases.
The /run/log/journal/* files are binary files and cannot be consumed by splunk.

If you run splunk forwarder as not root user then you need to modifiy file/folder permissions to allow splunk read logs in /var/log directory.

What is the problem you are currently have?

Run these commands on the linux splunk forwarder:

ps aux|grep -i splunk

ls -ld /var/log

ls -l /var/log/*log

Re: How to send journal logs to splunk ?

meenakande — Mon, 13 Apr 2020 13:26:59 GMT

we are trying to send journal logs under this location to splunk cloud
root@bos-server1:/run/log/journal/112824edd9f56398bab569035733662e# pwd
/run/log/journal/112824edd9f56398bab569035733662e