topic Printer logs in Getting Data In

Printer logs

aleksandarrrc — Mon, 15 Oct 2012 07:25:59 GMT

Hello,
Is there any manual, where i can see how to collect print logs from remote machine?
The printer from which i have to collect event logs is Lexmark X464 de.

Edit:
I configured Lexmark to send audit logs, to ip of the machine where Splunk is installed. I also configured syslog UDP port in SplunkWeb but it still don't collect event logs from printer.
Is there at least any command in cmd to test connections between printer and Splunk.
Thanks in advance.

Last Edit:
Sry for the question, problem solved!

Re: Printer logs

aleksandarrrc — Tue, 16 Oct 2012 08:40:04 GMT

The solution was to make sure, that both firewall and Antivirus are turned off.

Re: Printer logs

Drainy — Tue, 16 Oct 2012 08:44:37 GMT

Well, I wouldn't neccessarily say turn off the antivirus, just be sure that it isn't interfering with Splunks operation and that any built in firewall has exceptions for your ports. As I understand it you just had a botched install/uninstall which isn't quite the same as needing both off 🙂

Re: Printer logs

aleksandarrrc — Tue, 16 Oct 2012 10:45:11 GMT

That is certainly, more precise answer 🙂

Re: Printer logs

tskinnerivsec — Tue, 16 Oct 2012 10:55:04 GMT

I know you solved your issue, but the best way to test your connection between the printer and the splunk instance would be to use tcpdump if it is a linux system (tcpdump -i eth0 (or whatever your interface name is) port 514 (or whatever port you are sending syslog to). If splunk was running on a windows computer, you could use a tool like wireshark to listen for the syslog traffic. If you see the traffic and still didn't see it in your instance, I would check the host based firewall. Anti-virus shouldn't have anything to do with it.

Re: Printer logs

Drainy — Tue, 16 Oct 2012 10:59:11 GMT

In this case the packets were still arriving on the computer but a software firewall was playing up after a botched uninstall and was still blocking them, there was quite a bit of troubleshooting yesterday in the IRC channel 🙂