Universal Forwarder

hectorvp — Thu, 24 Sep 2020 09:57:50 GMT

Can we detect following from UFs internal logs:

Is TCP connection failed between UF and indexer/HF.

If UF dropped some logs for example from source A, there were 5 logs generated but sent only 4.(data loss)

Failed to monitor certain path or application.

Or are there any other useful info we can fetch from UFs internal logs???

Need to have health check over such 1000UFs.

PS: we don't have access to any other logs, not even indexers internal logs but only UFs logs.

Re: Universal Forwarder

gcusello — Thu, 24 Sep 2020 11:15:34 GMT

at first check the connection between your UF and the Indexer, e.g. using telnet (telnet indexer_IP_address 9997).

if it's open, you need to access the internal logs on Search head to understand if the UF is sending logs or not.

If it's closed, you have to solve this problem.

Ciao.

Giuseppe