Getting Data In
Highlighted

How do I set up inputs.conf to allow for a cloud application to send syslog over a SSL connection?

Contributor

Our anti-virus application is located in the "cloud" and is sending syslog data to the indexer over TCP port 6514. The application has the ability to use SSL to encrypt this data. Looking at previous answers, it looks like I should add [tcp-ssl://6514] to \etc\system\local\inputs.conf. After modifing the config and changing the remote end to use SSL, I get gibberish like this -

\x00\x00\x00 \x00\x00\x00
index = avprogram source = tcp:6514 sourcetype = syslog

When I remove the SSL requirement from the remote end, the data shows up as correct. It looks to me that I am missing a setting to decrypt the incoming data.

Any suggestions on what I need to do?

0 Karma
Highlighted

Re: How do I set up inputs.conf to allow for a cloud application to send syslog over a SSL connection?

Ultra Champion

Are you sure the TCP-SSL input is actually running properly? Did you remove the old TCP input config? Sounds like both are still in place and since splunk can only have 1 input on a TCP port, it picks the plain TCP input.

Try disabling/removing the old TCP input, or run the new input on another port, so you're sure you're troubleshooting the TCP-SSL input.

0 Karma
Highlighted

Re: How do I set up inputs.conf to allow for a cloud application to send syslog over a SSL connection?

Contributor

To get this to work, I had to remove the existing TCP input and add both the tcp-ssl and ssl sections.

0 Karma
Highlighted

Re: How do I set up inputs.conf to allow for a cloud application to send syslog over a SSL connection?

Ultra Champion

So that solved it? Or you mean you did that already before you encountered this problem of receiving gibberish?

0 Karma
Highlighted

Re: How do I set up inputs.conf to allow for a cloud application to send syslog over a SSL connection?

Contributor

To solve the issue, in inputs.conf

Removed [tcp://6514] stanza

Added
[tcp-ssl://6514]
connection_host = dns
sourcetype = syslog
index = avprogram

[SSL]
rootCA = E:\Splunk\etc\auth\cacert.pem
serverCert = E:\Splunk\etc\auth\server.pem
password = *******************

Note: I had to add the entire path because this is a Windows system.

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.