How to setup a Universal Forwarder to forward syslog data from firewall

[jbleich]

I have a windows 2019 SRV and will be installing splunk forwarder 8.0.4

I have a firewall and I have set the IP of this new server as it's syslog server. It's my understanding that the sonicwall sends this syslog information over port 514.

So how do I setup my syslog server w/ the Universal Forwarder to ingest and forward this data on to the indexer. Or do I need to setup a "listener" outside of splunk on the new syslog server to get the data to a log file and then simply use the forwarder to grab that log file and send to indexer?

[jbleich]

Thanks for that info, I'm not "scared" of linux it's just I dont use it a ton so when I have to work on it i have to retrain myself.......are there any options w/ a windows syslog server?

[richgalloway]

The second and third options in my answer may work on Windows, but I have seen or heard of anyone doing so.  "Windows" and "syslog" usually don't go in the same sentence.  Of course, the instructions are usually written for a Linux server so you'll have to translate everything into Windows-speak.

This may be a good opportunity to strengthen your Linux skills.  Splunk on Windows can be painful at times.

[richgalloway · Accepted solution]

The original way of doing syslog was to have Splunk listen on TCP and/or UDP port 514, but that's no longer recommended as it can lead to data loss when Splunk restarts.

The long-recommended method is the latter of your thoughts: set up a dedicated syslog listener (often syslog-ng), have it write received data to files, and have Splunk UF monitor those files.  That works pretty well.

The newest method is to use the Splunk Connect for Syslog (SC4S) app.  It creates a syslog-ng server in a container, listens for syslog events, and send them directly to a HEC input on your indexer(s).