Configure an intermediate forwarder

[Tumarbayev]

Hello team. 
My task is that universal forwarder should collect the events from other hosts and then do realy to main server. How can i do it? 

[Tumarbayev]

Last question. How can i configure the UF as a receiver on 9997? 

[Tumarbayev]

you mean i should configure the Universal forwarder on receiving mode and then on the sender server configure output to configured forwarder? 

[gcusello]

Hi @Tumarbayev,

yes, you have to configure the Intermediate Forwarder bot as receiver and forwarder.

If you use an HF you can do all by GUI, if you use a UF, you have to condifure outputs.conf and inputs.conf; if you use a UF, remember to configure in limits.conf maxKBpm=0 otherwise you'll have queues issues.

Then, in the target UFs, you have to configure outputs.conf to point to the intermediate Forwarder.

Ciao.

Giuseppe

[gcusello]

Hi @Tumarbayev,

let me understand:

are you speaking of an intermediate Forwarder that colelcts logs from other Universal Forwarder and sends them to indexers, is it correct?

Are you speaking of an Heavy or an Universal Forwarder?

Anyway, youcan use as concentrator, both a Universal or an Heavy Forwarder, even if I usually use an HF.

At first you have to configure your HF Concentrator to forwarder logs to the Indexers.

Then you have to enable, on HF,  receiving on a port (default 9997).

At least, you have to configure your target UFs to send their logs to the HF using the define port (9997).

If you have HA requirements, it's better to have two HFs to avoid Single Points of Failure.

Ciao.

Giuseppe