Deployment Architecture

how do i configure a linux box (not server) to send syslog events to a splunk deployment on linux?

dsepulveda
New Member

Hello,

My name is Daniel, i am evaluating Splunk to be used as a part of a SOC but i haven't been able to configure linux boxes (Debian) to send their log information to my splunk server, i've already set up a port to listen to on the server side, but haven't been able to make the clients send their logs in, can you please help me?

0 Karma

yannK
Splunk Employee
Splunk Employee

You have 3 methods :

Use syslog, and configure your linux boxes to send their syslog events to the indexer on the UDP port you opened. Variation : using rsyslog or syslog-ng to use TCP instead of UDP, and use another port than default 514.
On the indexer : enable input on UDP or TCP on the port used
Remark : on unix box, only root processes can listen to the port under 1024,
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Data/Monitornetworkports
please read your syslog service configuration to specify the destination server/port

OR

Install an UniversalForwarder on each boxes to monitor the log files (/var/log/ folder usually) and forward to the indexer on the port splunktcp
On the indexer : enable receiving in the manager.
see http://docs.splunk.com/Documentation/Splunk/4.3.2/Deploy/Aboutforwardingandreceivingdata
and http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitorfilesanddirectories

OR

A mixed configuration is to setup a syslog server that is receiving all the syslog event, then write to disk in files, and have splunk monitor those files.

mendesjo
Path Finder

Please, don't take it the wrong way, but how does that information help in setting up a unix server TO SEND syslog data over to a splunk box?

0 Karma

rdimri_splunk
Splunk Employee
Splunk Employee

@mendesjo ,the information provided about what you can do to send log information is the key. The actual process of setting up syslog to send data should be trivial.

0 Karma

mendesjo
Path Finder

Probably.. if you know unix. But since we don't that's why he's asking.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...