Heavy Forwarder, caching Win Events?

[FranzB]

Hey Guys,

im trying to configure an Splunk Heavy Forwarder, to cache his Windows Event Logs on the local Disk, in case the Indexer(in this scenario a thrid-party-system on a other server) is unreachable, and send it to the Indexer as soon as he is online again.

If tried to configure it in the Inputs.conf in this way:

[default]

host = server.domain

[WinEventLog:System]

persistentQueueSize=100GB

[WinEventLog:Security]

persistentQueueSize=100GB

Now i read this article: link text which says, that it is impossible to cache Windows event log data on the local disk(At least not with the persistentQueueSize-option).

Is there anyway to store the logs on the local disk and forward it the Indexer, as soon as he is available again?

Thanks for your response.

[FranzB]

Hey,

thanks for your quick answer, but regarding to your answer you maybe misunderstood me, so i explain our situation more detailed:

We got one Windowsserver which is configured as a Heavy Forwarder. He receive all the logs of our other Windowsserver(via WMI) and sends it to our third-party-system, which receive the logs and index/monitor them.

It works properly as long as the indexserver on the third-party-system is running. If the indexer now goes down(for maintenance or other reason) and it start again after the downtime we dont get the logs, which occured during the downtime, so we think that the Heavy Forwarder dont cache them for any reason.

The local Windows-Events of the server which runs the HF dont get lost, they just dont get send to the indexer(thanks for the edit but thats not the reason 😞 ).

Now our goal is to cache the local Win-events and the Win-Event which he receive of the other servers as long as the indexer is down and than send it to the indexer if he´s online again.

If we forward the logs to a other Win-server via tcp we got the same problems, that he dont store the local Win-events, am i right?

[gfuente]

Hello

What about sending this data to another forwared over TCP and then enable the persisten queue in that instance?

regards

EDIT:

If the HF is local to the windows events log being monitored, you could increase the size of that events logs, to avoid data loss if the data cant be forwarded during a certain amount of time