https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21049#M12115 <P><STRONG>If you want to collect the logs from within XenServer:</STRONG></P> <OL> <LI><P>Open XenCenter and right click on the XenServer you want to configure to send syslog to Splunk and select Properties.</P></LI> <LI><P>Click on the Log Destination tab</P></LI> <LI><P>Select the Remote selection</P></LI> <LI><P>Enter the IP address of the Splunk server</P></LI> <LI><P>Select OK</P></LI> <LI><P>Repeat the above steps for all remaining XenServers</P></LI> </OL> <P><STRONG>If you want the server messages, you will need to edit the syslog.conf file.</STRONG></P> <OL> <LI><P>vi /etc/syslog.conf</P></LI> <LI><P>Add the details you want to send to Splunk. Below is an example.</P> <P><EM>.crit;</EM>.emerg;<EM>.info;mail.</EM>;authpriv.<EM>;cron.</EM>;local6.* <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/149">@splunk</a>.localdomain</P></LI> </OL> <P>W*<EM>ithin Splunk, you need to make sure to listen on UDP port 514 to capture Syslog traffic.</EM>*</P> <OL> <LI><P>Open up Splunk and go to Manager</P></LI> <LI><P>Under Data, select Data inputs</P></LI> <LI><P>Under UDP, select Add new</P></LI> <LI><P>List item</P></LI> <LI><P>In UDP Port, type in 514. Under Source type, set the sourcetype to From list and then in the list choose syslog.</P></LI> <LI><P>List item</P></LI> <LI><P>Click Save</P></LI> </OL> Mon, 28 Sep 2020 12:10:04 GMT treinke 2020-09-28T12:10:04Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21047#M12113 <P>how to configure xenserver with splunk? any step by step document</P> Mon, 30 Jul 2012 13:34:23 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21047#M12113 leandesk 2012-07-30T13:34:23Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21048#M12114 <P>do mean install splunk on a xenserver or collecting xenserver data?</P> Mon, 30 Jul 2012 13:39:16 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21048#M12114 MarioM 2012-07-30T13:39:16Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21049#M12115 <P><STRONG>If you want to collect the logs from within XenServer:</STRONG></P> <OL> <LI><P>Open XenCenter and right click on the XenServer you want to configure to send syslog to Splunk and select Properties.</P></LI> <LI><P>Click on the Log Destination tab</P></LI> <LI><P>Select the Remote selection</P></LI> <LI><P>Enter the IP address of the Splunk server</P></LI> <LI><P>Select OK</P></LI> <LI><P>Repeat the above steps for all remaining XenServers</P></LI> </OL> <P><STRONG>If you want the server messages, you will need to edit the syslog.conf file.</STRONG></P> <OL> <LI><P>vi /etc/syslog.conf</P></LI> <LI><P>Add the details you want to send to Splunk. Below is an example.</P> <P><EM>.crit;</EM>.emerg;<EM>.info;mail.</EM>;authpriv.<EM>;cron.</EM>;local6.* <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/149">@splunk</a>.localdomain</P></LI> </OL> <P>W*<EM>ithin Splunk, you need to make sure to listen on UDP port 514 to capture Syslog traffic.</EM>*</P> <OL> <LI><P>Open up Splunk and go to Manager</P></LI> <LI><P>Under Data, select Data inputs</P></LI> <LI><P>Under UDP, select Add new</P></LI> <LI><P>List item</P></LI> <LI><P>In UDP Port, type in 514. Under Source type, set the sourcetype to From list and then in the list choose syslog.</P></LI> <LI><P>List item</P></LI> <LI><P>Click Save</P></LI> </OL> Mon, 28 Sep 2020 12:10:04 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21049#M12115 treinke 2020-09-28T12:10:04Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21050#M12116 <P>How to get this data for the app for xenserver?</P> Mon, 30 Jul 2012 15:28:02 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21050#M12116 leandesk 2012-07-30T15:28:02Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21051#M12117 <P>Do you mean XenApp and not XenServer? If you installed XenApp on a Unix/Linux system, according to the following article you need to add the user.info and user.notice to the syslog.conf file and then use the ctxcfg to configure the level of logging for the user connect/disconnect/reconnect/logoffs.</P> <P><A href="http://support.citrix.com/proddocs/topic/ps-unix/ps-unix-deploy-event-logging.html">http://support.citrix.com/proddocs/topic/ps-unix/ps-unix-deploy-event-logging.html</A></P> Mon, 30 Jul 2012 15:39:36 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21051#M12117 treinke 2012-07-30T15:39:36Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21052#M12118 <P>There is app splunk for xenserver . How to setup for xenserver pool</P> Mon, 30 Jul 2012 16:47:28 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21052#M12118 leandesk 2012-07-30T16:47:28Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21053#M12119 <P>I have never got that to work.</P> Mon, 30 Jul 2012 16:49:28 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21053#M12119 treinke 2012-07-30T16:49:28Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21054#M12120 <P>collecting xenserver data on to the splunk.</P> Wed, 27 Apr 2016 10:04:59 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21054#M12120 rajneeshsaraswa 2016-04-27T10:04:59Z https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21055#M12121 <P>I need to configure logs for below files to splunk.</P> <P>SMlog<BR /> audit:<BR /> messages: Xensource.log:</P> <P>how to set</P> Wed, 27 Apr 2016 11:14:13 GMT https://community.splunk.com/t5/Alerting/XenServer-5-6/m-p/21055#M12121 rajneeshsaraswa 2016-04-27T11:14:13Z