topic Re: How to get Cyberoam logs in splunk.? in Getting Data In

How to get Cyberoam logs in splunk.?

V4M51 — Tue, 14 Nov 2017 04:41:20 GMT

please help me in detail step-by step i have no idea on Cyberoam.

Re: How to get Cyberoam logs in splunk.?

kamlesh_vaghela — Tue, 14 Nov 2017 13:01:03 GMT

1st you have to Add Syslog server. Which forwarded to Cyberom log to the splunk server. This is Cyberom side configuration. Check below link for more info.

https://kb.cyberoam.com/default.asp?id=396

2nd Splunk side configuration. You have to do configuration to get data from TCP and UDP ports.
Check below link for more info.

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Monitornetworkports

3rd for field extraction download Cyberoam TA from Splunkbase and install into Splunk instance.

TA URL:

https://splunkbase.splunk.com/app/3126/

I hope this information will help you.

Thanks

Re: How to get Cyberoam logs in splunk.?

kamlesh_vaghela — Sat, 18 Nov 2017 17:16:37 GMT

Hi @V4M51,

Have you tried?

Thanks

Re: How to get Cyberoam logs in splunk.?

Richfez — Sun, 19 Nov 2017 14:47:00 GMT

@V4M51 If this answer helped you resolve your problem, please click the Accept button. If you need additional help, please ask!

@kamlesh_vaghela, I've converted this to an answer because I think it deserves to be one.

Happy Splunking,
-Rich

Re: How to get Cyberoam logs in splunk.?

haseenhussain — Mon, 27 Nov 2017 10:11:54 GMT

i followed these steps and after this , goto search & reporting in splunk , clicked on data summary ,but its only showing waiting for result, what is the problem ?, please help me

Re: How to get Cyberoam logs in splunk.?

kamlesh_vaghela — Mon, 27 Nov 2017 11:56:25 GMT

in which index/sourcetype your data is coming?
Cyberoam TA using cyberoam sourcetype.

Can you please check any data coming to splunk?

Re: How to get Cyberoam logs in splunk.?

haseenhussain — Mon, 27 Nov 2017 12:44:03 GMT

no data is coming from cyberoam to splunk

Re: How to get Cyberoam logs in splunk.?

kamlesh_vaghela — Mon, 27 Nov 2017 13:10:06 GMT

Hi
Can you please share implementation steps you did? like, how you forward cyberoam data to splunk,.. etc,.

Re: How to get Cyberoam logs in splunk.?

haseenhussain — Mon, 27 Nov 2017 13:17:52 GMT

in cyberoam ,
logs& reports-conf-syslog ser-add-
name-
ip/domain:- ip of pc(splunk installed pc)
port:-tcp 1024

Re: How to get Cyberoam logs in splunk.?

haseenhussain — Mon, 27 Nov 2017 13:40:05 GMT

and i also check port in my windows system but its only
showing "listening"

Re: How to get Cyberoam logs in splunk.?

saurabh_tek11 — Mon, 27 Nov 2017 15:18:05 GMT

Is that data reaching to syslog server ?
If yes, share your inputs.conf stanza where you are monitoring these logs
if no, check if the syslog configuration is correct / if there is any other device which might be blocking the incoming data to syslog.
if data is coming to syslog but not monitored by splunk then apparently your inputs stanza has area of improvement or local machine's OS firewall (where splunk is installed) that port is closed.

Thanks. - Saurabh

Re: How to get Cyberoam logs in splunk.?

saurabh_tek11 — Mon, 27 Nov 2017 16:01:24 GMT

Splunk's best practice is to write the networking device's logs to a intermediary syslog server (this is to ensure continuous availability of network devices logs irrespective of availability of splunk servers) , you may use syslog-ng or rsyslog - so have a syslog server
configure the cyberoam device to start sending the logs to syslog server's IP address
check if the logs are being written to syslog or not
if the logs are coming, then install the splunk universal forwarder on that syslog server which shall monitor these logs/directory and send them to your indexer IP on port 9997 with sourcetype: cyberoam & Index : *custom*
Monitor files and directories with inputs.conf (https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Monitorfilesanddirectorieswithinputs.conf)
Install Cyberoam addon on your splunk instances for automatic field extractions
search for index=* sourcetype=cyberoam

=====
Another direct approach can be -
a. configure the device to send logs directly to your indexer IP address on UDP 514
b. have the addon installed on your instances of splunk
c. open the port UDP:514 on splunk and on your splunk server's OS firewall

Input Type : UDP Port
Port Number : 514
Source name override : N/A
Restrict to Host : give IP of your device (1.2.3.4)
Source Type: cyberoam
App Context : search
Host : (IP address of the remote server)
Index : create new > cyberoam

d. ensure that there is no other device which might be blocking this data movement

e. search for index=* sourcetype=cyberoam