Planning to have syslog-ng on one of our heavy forwarder

New Member

Syslog configuration

we have 2 newly buildup heavy forwarders in our splunk environment, instead of having syslog-ng on separate dedicated servers, we thought of download/install syslog-ng on one of our Heavy Forwarder. is this recommendable? if yes, can someone please send me if there is any documentation??

Thank You,

Tags (1)
0 Karma


It is completely fine if you install Syslog-ng on your Heavy Forwarder. There are advantages to this. I am enlisting a few points below please consider them

  1. Heavy Forwarders need higher resources as compared to Universal Forwarders. Please make sure you have enough resources.
  2. As with Heavy Forwarder, you might not be indexing all the data that is received. A plain HF with no indexing requires less storage. But when we switch to Syslog-ng, the storage requirements increase based on the amount of data we ingest.
  3. We need to take care of the log rotation, in case we have a huge volume of data coming to the Syslog server. If the disk gets full, Syslog server might stop working and we lose in-flight data. Old and Indexed data should be removed / archived on time.
  4. Using Syslog server, it is more convenient to manage data before indexing it in Splunk.

Hope the above points are helpful.

0 Karma


You can configure syslog-ng on Heavy Forwarder but make sure the server should have sufficient resources. Here is the link for configuring syslog-ng with Splunk.

Hope this helps..

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST