Archive

Need info on Agentless log monitoring solution available in Splunk.

New Member

I want to setup the agentless log monitoring solution for unix and linux servers, what is the procedure to acheive this ? Shuld i use Splunk forwarder for this ?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You could utilize syslog if you do not want to install a forwarder on the linux/unix systems in question. Best practice would be to setup a host, running a syslog daemon, such as rsyslog or syslog-ng (a syslog aggregator). This host would also have a Splunk forwarder on it, to read and forward the logs collected from your "agentless" systems.

Splunk Employee
Splunk Employee

A heavy forwarder can filter logs but what I think you want is to forward the logs, in their entirety, to the indexer, using a universal forwarder. The indexer component of Splunk then stores and indexes the logs so they can be parsed, searched, have alerts generated from, etc from the search head (note that the search head could be the same physical device as the indexer, in a small environment).

Splunk provides awesome documentation that can get you started (I use it frequently myself 😉 😞
http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunkTutorial

New Member

Using the forwarder, can i filter a string in the log file and generate alerts? Ex : I wan to monitor only 2 strings in a perticualr log file. Strings are "Error","Warn".
Is it possible to acheive the above scenario? Could you please help me with the doc as well for this, since i am very new to this tool.

0 Karma

Legend

The preferred way is to use a forwarder, yes. However by definition this would no longer be "agentless" - not sure why you'd want it to be agentless though...

New Member

Using the forwarder, can i filter a string in the log file and generate alerts? Ex : I wan to monitor only 2 strings in a perticualr log file. Strings are "Error","Warn".
Is it possible to acheive the above scenario? Could you please help me with the doc as well for this, since i am very new to this tool.

0 Karma