Dedicated Syslog collector or Splunk at port 514

[michael_lee]

I read somewhere that it's not advisable to use Splunk at port 514 to collect syslog events but instead us a dedicated syslog server. If there is a change to Splunk configuration that needs a restart of the instance, it will not affect the syslog collection. In that case if Splunk is not collecting syslog, how can one read the syslog events from the syslog server into Splunk? Do we need to use a forwarder in this case?
thanks

[Richfez]

Allow me a slightly different take, though still echoing the general principles.

In a smaller environment you can install and use syslog (either r-syslog or syslog-ng) on the same box where Splunk is installed. It's not ideal, but honestly the needs of syslog are small and as long as you log-rotate properly you shouldn't significant disk space requirements beyond what the data needs in Splunk.

If you do that, you do not need a forwarder and can simply have Splunk read the files directly from the local filesystem. Simple and straightforward.

[dwaddle]

One good reference to good practices here is George Starcher's blog post, http://www.georgestarcher.com/splunk-success-with-syslog/. While it is rsyslog specific, the same concepts apply to syslog-ng. Between the two, I would recommend syslog-ng if you have a choice as its a bit easier to grok the configuration of.

[javiergn]

Hi,

We are planning to have two instances of Syslog-ng configured with the same virtual IP for failover purposes, writing Syslog traffic to the local disk. Then we run a local universal forwarder on each syslog server to read those log files. You don't really need a heavy forwarder for that.

Thanks,
J

[a212830 · Accepted solution]

Correct - if you reading UDP syslog from a port using Splunk, then you run the risk of losing data when you restart Splunk. Most people send syslog to a syslog daemon (rsyslog or syslog-ng) and then write the files out to disk, and then read those files using a HFW. If you use this method (possibly with a load-balancer) then you reduce the risk of losing syslog messages.