Getting Data In

How to forward a specific syslog file into Splunk?

Explorer

Hello all,

I'm looking for guidance about a logging problem I am trying to solve. Right now we have a few security onion boxes sending snort logs to both our log server and to Splunk using syslog-ng. This works fine.

The powers that be now want to remove the direct send to Splunk and just pipe the logs from the syslog box into Splunk. What I would like to do is just forward these specific log files which are under /var/log/remote/IP1, /var/log/remote/IP2 to the Splunk box. Is there an easy way to accomplish this or do I need to get cute with eventtypes..etc? Hopefully that makes sense.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

If you have the UF on your syslog collector, just configure your inputs to monitor those files. Example inputs.conf:

[monitor:///var/log/remote/IP1]
host=IP1
sourcetype=syslog
index=syslogidx

[monitor:///var/log/remote/IP2]
host=IP2
sourcetype=syslog
index=syslogidx

If you need something more sophisticated, explain that scenario.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

If you have the UF on your syslog collector, just configure your inputs to monitor those files. Example inputs.conf:

[monitor:///var/log/remote/IP1]
host=IP1
sourcetype=syslog
index=syslogidx

[monitor:///var/log/remote/IP2]
host=IP2
sourcetype=syslog
index=syslogidx

If you need something more sophisticated, explain that scenario.

View solution in original post

0 Karma

Explorer

I ended up setting up a forward in rsyslog. So it logs into /var/log/remote/ip.log then forwards to Splunk.
if $fromhost-ip=='192.168.211.2' then @192.168.211.3:514

Is it better to use the universal forwarder?

0 Karma

SplunkTrust
SplunkTrust

Yes, the universal forwarder is better. It handles retry, throttling, and more that rsyslog doesn't.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Most definitely I agree. It's too easy to loose syslog data. The forwarder on the syslog server is the best way to go.

0 Karma

Explorer

Thanks for your help.

0 Karma

SplunkTrust
SplunkTrust

Piping syslog through an intermediate server is accepted Best Practice to avoid losing data.

---
If this reply helps you, an upvote would be appreciated.
0 Karma