I installed the Technology Add-on for Cisco Secure Access Control Server (ACS) to a heavy forwarder and pointed the Cisco ACS device to send data to the heavy forwarder via udp 9010. I created an inputs.conf file with the following :
[udp://9010]
connection_host = dns
disabled = 0
followTail = 0
sourcetype = cisco:acs
crcSalt =
index = cisco_secure_acs
and ensured that the port is opened however I am still unable to see any data in the index. Anyone have any ideas?
Sniff the port with tcpdump
and see if the traffic is getting there. If missing, make sure that the sender is using UDP
, not TCP
and make sure that ACL/firewall/routes/etc. are allowing the traffic. But you should not be sending directly to Indexers, you should be sending to a syslog aggregator like syslog-ng and doing this: