how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux?

[dsepulveda]

Hello,

My name is Daniel, i am evaluating Splunk to be used as a part of a SOC but i haven't been able to configure linux boxes (Debian) to send their log information to my splunk server, i've already set up a port to listen to on the server side, but haven't been able to make the clients send their logs in, can you please help me?

[yannK]

You have 3 methods :

Use syslog, and configure your linux boxes to send their syslog events to the indexer on the UDP port you opened. Variation : using rsyslog or syslog-ng to use TCP instead of UDP, and use another port than default 514.
On the indexer : enable input on UDP or TCP on the port used
Remark : on unix box, only root processes can listen to the port under 1024,
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Data/Monitornetworkports
please read your syslog service configuration to specify the destination server/port

OR

Install an UniversalForwarder on each boxes to monitor the log files (/var/log/ folder usually) and forward to the indexer on the port splunktcp
On the indexer : enable receiving in the manager.
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/Aboutforwardingandreceivingdata
and http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories

OR

A mixed configuration is to setup a syslog server that is receiving all the syslog event, then write to disk in files, and have splunk monitor those files.

[mendesjo]

Please, don't take it the wrong way, but how does that information help in setting up a unix server TO SEND syslog data over to a splunk box?

[rdimri_splunk]

@mendesjo ,the information provided about what you can do to send log information is the key. The actual process of setting up syslog to send data should be trivial.

[mendesjo]

Probably.. if you know unix. But since we don't that's why he's asking.