How to make universal forwarder to receive syslogs and forward to Splunk cloud?

[brat_1990]

We have a situation where the application sends the logs in syslog format. But we don't have a Syslog server to receive it.

Instead, can we make the UF (installed in the same app server) receive those syslog events and forward them to Splunk Cloud?

Note: We don't have the physical location of the logs in the app server to monitor using UF

[gcusello]

Hi @brat_1990 ,

if you have a Linux server, you could configure an rsyslog server that writes syslogs in files that you cn read using the UF.

Otherwise you could install the SC4S app (that's a syslog-ng server).

Last choise to use an Heavy Forwarder.

My hint is to use a rsyslog server ( I usually do this).

Ciao.

Giuseppe

[brat_1990]

Hi @gcusello,

Appreciate your response and support.

Since we are using a Windows server for the application I might want to know more about this aspect, please.

The below link suggests using UF to monitor TCP/UDP. Please share your take on the same

Both Splunk Enterprise and the universal forwarder support monitoring over UDP

Also, I would like to know if the SC4S app can be installed directly on the Windows server or if it needs any *nix environment to work.

[PickleRick]

You can use UF (or HF) for directly monitoring network input (tcp or udp port). Be aware however of shotcomings of such solution.

1. You can only define one sourcetype for a given input so if you want to listen for data from several different sources yoh have to either create multiple inputs or do some complicated index-time rewriting and rerouting. Not easy to maintain.

2. There used to be some performance problems compared to a specialized syslog daemon

3. You lose network-level metadata.

So if you can live witn that, you can define a tcp or udp input and live with that. But it's not a recommended solution.

[brat_1990]

Hello @PickleRick ,

Thank you for the detailed information.

I have gone through the shortcomings and I guess I'll work through that. However, could you please guide me on the inputs.conf and outputs.conf for cloud.

Is there a way to validate if the UF is receiving logs? 

[gcusello]

hi @brat_1990 ,

rsyslog and SC4S require alinux UF.

in documentation is described (I never tried) that it's possible to enable syslog receiving also on a Windows Universal Forwarder (surely it's possible on an Heavy Forwarder), obviously manually inserting inputs in inputs.conf file.

Ciao.

Giuseppe