How to install the Splunk forwarder on a BlueCat DNS/DHCP Server?

[hessf]

Has anyone successfully installed the Splunk Forwarder on a BlueCat DNS/DHCP Server or otherwise got full DNS logging into Splunk from one?

[adonio]

Works well when writing Bluecat data to syslog and using a forwarder to monitor the logs directories
correctly looking on nice data from Bluecat through syslog-ng
info.log
debug.log
notice.log
warning.log
err.log

hope it helps

[lguinn2]

I haven't, but I have a question - what is the underlying OS? And do you have command line access to the server, with sufficient privileges to install software? Splunk forwarders don't require elevated privileges to run, but you do have to get them installed at the very least.

[hessf]

It's Debian-based but there are no repositories for dependencies. We have the privileges but we've seen our modifications on these blown away before during upgrades so I was hoping to hear from a customer with experience.

[TWiseOne]

Hi, did you ever get an answer to this, or install the UF successfully on your Bluecat system?

I am currently looking into how to retrieve the logs required for DNS and have no Bluecat experience so knowing whether I can use a UF on the device/OS would be of great help to get me started.

Thanks,

T