Getting Data In

Forwarding syslog to 3rd Party system

MHibbin
Influencer

Hey,

We need to configure some of our UDP syslog to go to the indexer via a 3rd party security appliance.

The following documentation states that the output will be RFC compliant (great!):

http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Forwarddatatothird-partysystemsd#Forward_sy...

However, before we proceed, I would like to check whether the forwarders will queue this data in the same way it does when forwarding to the indexer, does this happen? - obviously we would look to do this communication over TCP.

Cheers,

Matt

1 Solution

yannK
Splunk Employee
Splunk Employee

If you have a heavy forwarder (not working in UF or LWF) with the syslog forwarding configured.
It will send the matching events as syslog at the same step it would : forward to other splunk, write to disk in a local index.

So if any queues are full (splunk indexer not accessible, local index full, or syslog server not responding), then it will pause the whole indexing process on all channels, once the queues are full. As for regular splunk forwarding.

So If you were receiving non persistent data (like UDP/TCP), I would recommend to use a file buffer before the forwarder. By example monitor a log file on disk, or use persistent queues.

View solution in original post

yannK
Splunk Employee
Splunk Employee

If you have a heavy forwarder (not working in UF or LWF) with the syslog forwarding configured.
It will send the matching events as syslog at the same step it would : forward to other splunk, write to disk in a local index.

So if any queues are full (splunk indexer not accessible, local index full, or syslog server not responding), then it will pause the whole indexing process on all channels, once the queues are full. As for regular splunk forwarding.

So If you were receiving non persistent data (like UDP/TCP), I would recommend to use a file buffer before the forwarder. By example monitor a log file on disk, or use persistent queues.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!