Getting Data In

How to send syslog using rsyslog over TCP encrypted with TLS?

im_bharath
Path Finder

Hello All,

Currently a certain application is sending the data to splunk via syslog method(rsyslog) using TCP, so now the application team want to try and send the data using the syslog (rsyslog) over TCP with TLS encryption, 

Can any one please help me how this can be achieved, and it would be really awesome if anybody can provide leads on any splunk documentation or links available for reference. 

Thanks.

Labels (3)
0 Karma

Silah
Path Finder

Hello

I have been trying to send logs to a Splunk TCP input using rsyslog but I cannot make it work. I know this is not related to your question but is there any way you can share how you did it ?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If you are already receiving syslog on your rsyslog, it's better to send it to splunk using HEC input on Splunk's side and omhttp action on rsyslog's side.

0 Karma

yeahnah
Motivator

Hi @im_bharath 

There's some information here:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Configure_an_encrypted_...

Basically, configure a tcp-ssl stanza in the inputs.conf file on the receiving Splunk server:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#TCP:_Transport_Control_Protocol...

yeahnah_0-1681167388951.png

You'll need to put the public SSL/TLS cert for the rsyslog server on the Splunk receiver and configure these too (ensure the certs are readable to the Splunk process).  It's likely you'll need to configured the cert parameters under your tcp-ssl stanza (not the global SSL stanza) for this single TCP TLS port.  Ensure the Splunk receiver is restarted once configured too.

Once configured right you should be able to test the Splunk receiving port is configured and listening for incoming encrypted  data OK using openssl, e.g.

On a *NIX server

splunk$ echo | openssl s_client -connect <splunk receiver>:<port> 2>/dev/null | openssl x509 -noout -subject -dates

Hope this helps to get you started.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...