Blue Coat ProxySG

[raydarvi]

I have a pair of BC ProxySG sending logs to a FTP server, then BC reporter is pulling the loggs from it. Now trying to make Splunk work with the current setup simultaneously while comparing it, the instructions about BC integration is not clear to me. Can someone explain the overall steps and possibly give examples with fictional device names and log paths?

[xavierashe]

Your best solution is to install the universal forwarder on the FTP server. Then Splunk can monitor the files directly.

The next option to consider is using the FTP Reciever App. It's not Splunk built or supported, but it may work for you.

[koshyk]

we use syslog to collect BC data. But thinking about your set-up, can Splunk monitor file from the FTP server? what OS FTP runs on? Can you setup syslog sender in that if you cannot install Splunk UF?

[raydarvi]

OK my ProxySGs are saving logs in this format: SG_%f_%c_%l%m%d%H%M%S.log in FTP server. I can access them using a FTP client by ftp://ray@10.1.1.1/BlueCoat, but not sure what to put in the first line of the inputs.conf file indicated here:

[monitor://<log path>]

I put the following but no luck:

[monitor:///10.1.1.1/BlueCoat]

How the Splunk is supposed to authenticate with the FTP server? Where do I indicate that?

Or it doesn't work this way and a forwarder on the FTP server needs to be setup to send the logs to Splunk?

[jimmccarthy]

The monitor stanza simply tells Splunk, or the UF, where to look for logs. There might be a couple of ways to do this: 1) install the UF on your BC reporter and leverage that to pull your logs into Splunk or 2) There is a new splunkbase app called "importutil". It lets you import csv files (or any input) from an http url via the Splunk search command line and also works for ftp 3) A custom TCP connection.

I'm also dropping in a link; happy Splunking!

http://docs.splunk.com/Documentation/Splunk/6.5.3/Data/Configureyourinputs