Best way to use a syslog server and splunk indexer

[reswob4]

I have just built a brandy new syslog server. The purpose of this server is to provide a buffer so that instead of sending all syslog traffic directly to my indexers and losing data when I have to restart the indexers for various reasons or the connectivity drops or whatever, all that traffic comes to the syslog server which then gets sent to the indexers. The idea is that this machine would be capable of buffering events if the indexer can't be reached.

So my question is this: Is it best to:

1. receive remote logs via syslog, write them to a local file/database and then use a universal forwarder to send to indexers
2. receive remote logs via syslog, write them to a local file/database and then use a heavy forwarder to send to indexers
3. receive remote logs via syslog, and use syslog to forward again to indexers

Thanks.

Oh, and IF #1, how many universal forwarders can you have on a single machine?

[reswob4]

Thanks.

Using #1.

I'm having a weird issue though. I will post another question to deal with that...

[yannK · Accepted solution]

The first one is the best if your syslog server is not the indexer.

1 . receive remote logs via syslog, write them to a local file/database and then use a universal forwarder to send to indexers

Otherwise option 4.

4 . receive remote logs via syslog, write them to a local file on the indexers and monitor locally.