How to send syslog using rsyslog over TCP encrypted with TLS?

[im_bharath]

Hello All,

Currently a certain application is sending the data to splunk via syslog method(rsyslog) using TCP, so now the application team want to try and send the data using the syslog (rsyslog) over TCP with TLS encryption, 

Can any one please help me how this can be achieved, and it would be really awesome if anybody can provide leads on any splunk documentation or links available for reference. 

Thanks.

[yeahnah]

Hi @im_bharath 

There's some information here:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Configure_an_encrypted_...

Basically, configure a tcp-ssl stanza in the inputs.conf file on the receiving Splunk server:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#TCP:_Transport_Control_Protocol...

You'll need to put the public SSL/TLS cert for the rsyslog server on the Splunk receiver and configure these too (ensure the certs are readable to the Splunk process).  It's likely you'll need to configured the cert parameters under your tcp-ssl stanza (not the global SSL stanza) for this single TCP TLS port.  Ensure the Splunk receiver is restarted once configured too.

Once configured right you should be able to test the Splunk receiving port is configured and listening for incoming encrypted  data OK using openssl, e.g.

On a *NIX server

splunk$ echo | openssl s_client -connect <splunk receiver>:<port> 2>/dev/null | openssl x509 -noout -subject -dates

Hope this helps to get you started.