- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I have have 1 Linux Server (Ubuntu) and 1 Splunk Instance (CentOS).
I need to see performance of Linux Server with Splunk App for Unix and Linux. But my customer doesn't want to me install a universal forwarder on his server.
How can Splunk get logs from Linux Server without installing a Universal Forwarder?
sorry for my english 🙂
Thank you for advance
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi tumdev,
you could use syslog to forward the Ubuntu logs to the Splunk indexer or mount the Ubuntu's /var/log
on the Splunk indexer and read the logs this way.
To get the performance data, some script must be run on the Ubuntu server that writes those figures into either syslog or a log file in /var/log
.
hope this helps to get you started ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi tumdev,
you could use syslog to forward the Ubuntu logs to the Splunk indexer or mount the Ubuntu's /var/log
on the Splunk indexer and read the logs this way.
To get the performance data, some script must be run on the Ubuntu server that writes those figures into either syslog or a log file in /var/log
.
hope this helps to get you started ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I suggest that if you are going to use syslog you make it syslog over TCP (by default it is UDP), and that you use (Balabit's) syslog-ng as your syslog server - it is way more configurable than the default rsyslogd.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, Mus 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're pretty much on your own - Splunk's way of grabbing this data IS via forwarders. If your customer don't want forwarders, there's no ready-made alternate solution. You should be spending your time explaining this to your customer instead.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your suggest.
Can you preview or keep me some document please
thank you
