topic Re: Heavy Forwarders stopped receiving some logs in Getting Data In

Heavy Forwarders stopped receiving some logs

vnguyen46 — Thu, 13 Feb 2020 20:44:46 GMT

Hi,

I have a new HF once accepted logs for about a week, then stopped receiving on almost all logs at a same time.
I compared this HF with the old working one and I don't see rotated logs created on the new HF.

For instance, in log1 directory, I see log1.log and several other copies like log1.log-date1.gz and log1.log-date2.gz and so on, but on the new HF I only see log1.log.

I think not creating rotated logs on the HF could be the issue, but not sure and how to have these rotated logs created.
Anyone can help, I appreciate it.

Thanks,

Re: Heavy Forwarders stopped receiving some logs

richgalloway — Thu, 13 Feb 2020 20:53:01 GMT

Have you verified the new HF is running (splunk status)?

Re: Heavy Forwarders stopped receiving some logs

vnguyen46 — Thu, 13 Feb 2020 20:59:30 GMT

Hi - yes, it's running. I don't see any .gz files in any directories.

Re: Heavy Forwarders stopped receiving some logs

richgalloway — Fri, 14 Feb 2020 01:01:19 GMT

Heavy Forwarders typically don't use a directory called "log1" so I wonder if you're looking at a syslog directory. If so, make sure the syslog process is running and data sources are still sending to it (no new firewall rule is blocking them, for instance).

Re: Heavy Forwarders stopped receiving some logs

vnguyen46 — Fri, 14 Feb 2020 12:34:14 GMT

Hi richgalloway - on HF, log stored at: /opt/splunklogs/hostname/hostname.log
I also see some files like hostname.log-timestamp.gz. Are these .gz files created by Splunk and supposed to be there?

Thank you,

Re: Heavy Forwarders stopped receiving some logs

isoutamo — Fri, 14 Feb 2020 21:44:28 GMT

Usually those are created e.g. some syllogism variant not Splunk. You should figure out which tool is used on your environment to deliver / received those logs. Many times it is syslog, syslog-ng or rsyslog. And on network topology there could be a load balancer before those HF hosts to distribute events to all of those hosts.

And probably there is also some log rotation tools to rotate and zip those logs?

R. Ismo