Forwarding syslog to 3rd Party system

[MHibbin]

Hey,

We need to configure some of our UDP syslog to go to the indexer via a 3rd party security appliance.

The following documentation states that the output will be RFC compliant (great!):

http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Forwarddatatothird-partysystemsd#Forward_sy...

However, before we proceed, I would like to check whether the forwarders will queue this data in the same way it does when forwarding to the indexer, does this happen? - obviously we would look to do this communication over TCP.

Cheers,

Matt

[yannK · Accepted solution]

If you have a heavy forwarder (not working in UF or LWF) with the syslog forwarding configured.
It will send the matching events as syslog at the same step it would : forward to other splunk, write to disk in a local index.

So if any queues are full (splunk indexer not accessible, local index full, or syslog server not responding), then it will pause the whole indexing process on all channels, once the queues are full. As for regular splunk forwarding.

So If you were receiving non persistent data (like UDP/TCP), I would recommend to use a file buffer before the forwarder. By example monitor a log file on disk, or use persistent queues.