Getting Data In

How to send journal logs to splunk ?

meenakande
New Member

How do i send journal logs to splunk??

journalctl -u servicename

Here journal logs are raw logs. Will splunk read raw logs ?

Configuration setup on my bos-server1
root@bos-server1#/opt/splunkforwarder/etc/apps/linux_auth/default# cat inputs.conf
[monitor:///var/log/auth*.log]
sourcetype = linux_authlog
index = linux_log
disabled = false

[monitor:///var/log/syslog]
sourcetype = linux_syslog
index = linux_log
disabled = false

Below journal logs location:

root@bos-server1:/run/log/journal/112824edd9f56398bab569035733662e# pwd
/run/log/journal/112824edd9f56398bab569035733662e
root@bos-rndapp02:/run/log/journal/112824edd9f56398bab569035733662e# ls -al
total 344472
drwxr-s---+ 2 root systemd-journal 220 Jan 21 13:40 .
drwxr-sr-x 3 root systemd-journal 60 Sep 21 08:06 ..
-rw-r-----+ 1 root systemd-journal 41943040 Jan 14 02:57 system@dcf33424670b4269a8a8b1b6b5b86200-000000000043823d-00059bfe728bd765.journal
-rw-r-----+ 1 root systemd-journal 42151936 Jan 15 01:07 system@dcf33424670b4269a8a8b1b6b5b86200-0000000000443355-00059c14f222a797.journal

0 Karma

meenakande
New Member

we are trying to send journal logs under this location to splunk cloud
root@bos-server1:/run/log/journal/112824edd9f56398bab569035733662e# pwd
/run/log/journal/112824edd9f56398bab569035733662e

0 Karma

PavelP
Motivator

Hello @meenakande ,

depending on OS, the journal logs usually duplicated in various /var/log/*log so just by monitoring them with monitor stanza as you mentioned should work in most cases.
The /run/log/journal/* files are binary files and cannot be consumed by splunk.

If you run splunk forwarder as not root user then you need to modifiy file/folder permissions to allow splunk read logs in /var/log directory.

What is the problem you are currently have?

Run these commands on the linux splunk forwarder:

ps aux|grep -i splunk

ls -ld /var/log

ls -l /var/log/*log
0 Karma

richgalloway
SplunkTrust
SplunkTrust

When you restart Splunk (or the forwarder if that is what you are using) after changing the inputs.conf file, data should be sent to Splunk. What do you get when you search index=linux_log?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...