topic Re: Syslog vs Forwarders in Getting Data In

Syslog vs Forwarders

bpladna81 — Thu, 21 Nov 2019 00:23:40 GMT

If I have an environment with an rsyslog collection server that is working just fine and collecting from thousands of endpoints, should I keep that or get rid of that and collect events using a UF on each endpoint?

Re: Syslog vs Forwarders

MuS — Thu, 21 Nov 2019 01:38:25 GMT

Hi bpladna81,

Keep your rsyslog server for the syslog collection and install an universal forwarder on the same server to monitor the files the rsyslog server creates. Some good background information is available here http://www.georgestarcher.com/splunk-success-with-syslog/

Hope this helps ...

cheers, MuS

Re: Syslog vs Forwarders

woodcock — Thu, 21 Nov 2019 03:37:35 GMT

You will always need a syslog server but there are many good reasons to go with syslog-ng. I would not make this change unless you frequently need to adjust what is sent and you cannot admin directly. With UFs/DS you can admin all of your splunk configurations by yourself