Polycom Video Infrastructure - Monitoring with Splunk

ashishsinghal — Tue, 09 Jul 2019 09:04:23 GMT

Any success story for this integration ? Right now i am stuck as i am trying to forward Polycom DMA syslogs to splunk and as Polycom uses UDP 514 & as this is a reserve port Splunk can't accept logs from Polcyom. Please advise, if there are other ways.

I am focusing on Quality Monitoring, end point registration & MCUs utilization.

Re: Polycom Video Infrastructure - Monitoring with Splunk

tiagofbmm — Tue, 09 Jul 2019 10:21:00 GMT

You can send logs to Splunk and configure any available port to listen to those syslog messages:

[tcp://<remote server>:<port>]
* Configures the input to listen on a specific TCP network port.

[udp://<remote server>:<port>]
* Configures the input to listen on a specific UDP network port.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

Usually sending syslog directly to Splunk is not a best practice but you could instead use an intermediate Syslog-NG or Rsyslog to write it to disk, and have a Splunk UF monitoring those files.

If your Polycom can send HTTP data, you can also enabel HEC on Splunk Indexers and listen to that stream of data directly into Splunk:

https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/UsetheHTTPEventCollector

topic Polycom Video Infrastructure - Monitoring with Splunk in Monitoring Splunk

Polycom Video Infrastructure - Monitoring with Splunk

Re: Polycom Video Infrastructure - Monitoring with Splunk