Monitor statement for syslog server

basketballah21 — Mon, 25 Mar 2019 02:57:30 GMT

Trying to figure out the correct monitor statement for my inputs.conf for logs being sent to my syslog server.
/var/log/syslog is where the logs are coming to.
Under /var/log/syslog each remote server has its own directory (some are hostnames, some named IPs) and the logs files are underneath there.

The location of the logs:
/var/log/syslog/server1.net.domain/server1.net.domain.log
/var/log/syslog/server.2.net.fw.domain/server.2.net.fw.domain.log
/var/log/syslog/192.168.45.21/192.168.45.21.log
/var/log/syslog/10.4.5.1/10.4.5.1.log

Re: Monitor statement for syslog server

whrg — Mon, 25 Mar 2019 07:49:24 GMT

Hello @basketballah21,

The advantage of each remote server having its own subdirectory is you can use the "host_segment" option:

# inputs.conf
[monitor:///var/data/syslog/*/*.log]
index = YOURINDEX
sourcetype = syslog
host_segment = 4

So, for example, log files under /var/log/syslog/server1.net.domain/server1.net.domain.log will get host=server1.net.domain.

You will need a small modification though:

# props.conf
[syslog]
TRANSFORMS =

The syslog sourcetype has the property "TRANSFORMS = syslog-host" (etc/system/default/props.conf). This will set the host value based on a regex. You should disable this via "TRANSFORMS =" if you are using the "host_segment" option.

Put these two conf files under etc/apps/yourapp/default or etc/system/local. Restart Splunk after making changes to configuration files.

If necessary, you can also create your own sourcetype via props.conf. This might be the case if the default syslog sourcetype does not correctly recognize the timestamps for your logs.

topic Re: Monitor statement for syslog server in Monitoring Splunk

Monitor statement for syslog server

Re: Monitor statement for syslog server