Getting Data In

How to setup a Universal Forwarder to forward syslog data from firewall

jbleich
Path Finder

I have a windows 2019 SRV and will be installing splunk forwarder 8.0.4

I have a firewall and I have set the IP of this new server as it's syslog server. It's my understanding that the sonicwall sends this syslog information over port 514.

 

So how do I setup my syslog server w/ the Universal Forwarder to ingest and forward this data on to the indexer. Or do I need to setup a "listener" outside of splunk on the new syslog server to get the data to a log file and then simply use the forwarder to grab that log file and send to indexer?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The original way of doing syslog was to have Splunk listen on TCP and/or UDP port 514, but that's no longer recommended as it can lead to data loss when Splunk restarts.

The long-recommended method is the latter of your thoughts: set up a dedicated syslog listener (often syslog-ng), have it write received data to files, and have Splunk UF monitor those files.  That works pretty well.

The newest method is to use the Splunk Connect for Syslog (SC4S) app.  It creates a syslog-ng server in a container, listens for syslog events, and send them directly to a HEC input on your indexer(s).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

jbleich
Path Finder

Thanks for that info, I'm not "scared" of linux it's just I dont use it a ton so when I have to work on it i have to retrain myself.......are there any options w/ a windows syslog server?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The second and third options in my answer may work on Windows, but I have seen or heard of anyone doing so.  "Windows" and "syslog" usually don't go in the same sentence.  Of course, the instructions are usually written for a Linux server so you'll have to translate everything into Windows-speak.

This may be a good opportunity to strengthen your Linux skills.  Splunk on Windows can be painful at times.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The original way of doing syslog was to have Splunk listen on TCP and/or UDP port 514, but that's no longer recommended as it can lead to data loss when Splunk restarts.

The long-recommended method is the latter of your thoughts: set up a dedicated syslog listener (often syslog-ng), have it write received data to files, and have Splunk UF monitor those files.  That works pretty well.

The newest method is to use the Splunk Connect for Syslog (SC4S) app.  It creates a syslog-ng server in a container, listens for syslog events, and send them directly to a HEC input on your indexer(s).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...