How to send syslog using rsyslog over TCP encrypted with TLS?

[im_bharath]

Hello All,

Currently a certain application is sending the data to splunk via syslog method(rsyslog) using TCP, so now the application team want to try and send the data using the syslog (rsyslog) over TCP with TLS encryption, 

Can any one please help me how this can be achieved, and it would be really awesome if anybody can provide leads on any splunk documentation or links available for reference. 

Thanks.

[Silah]

Hello

I have been trying to send logs to a Splunk TCP input using rsyslog but I cannot make it work. I know this is not related to your question but is there any way you can share how you did it ?

[PickleRick]

If you are already receiving syslog on your rsyslog, it's better to send it to splunk using HEC input on Splunk's side and omhttp action on rsyslog's side.

[yeahnah]

Hi @im_bharath 

There's some information here:

https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Configure_an_encrypted_...

Basically, configure a tcp-ssl stanza in the inputs.conf file on the receiving Splunk server:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#TCP:_Transport_Control_Protocol...

You'll need to put the public SSL/TLS cert for the rsyslog server on the Splunk receiver and configure these too (ensure the certs are readable to the Splunk process).  It's likely you'll need to configured the cert parameters under your tcp-ssl stanza (not the global SSL stanza) for this single TCP TLS port.  Ensure the Splunk receiver is restarted once configured too.

Once configured right you should be able to test the Splunk receiving port is configured and listening for incoming encrypted  data OK using openssl, e.g.

On a *NIX server

splunk$ echo | openssl s_client -connect <splunk receiver>:<port> 2>/dev/null | openssl x509 -noout -subject -dates

Hope this helps to get you started.