Getting Data In
Highlighted

Identify IP address from host

Communicator

Hi,

We are seeing two suspicious servers which are sending syslogs in huge count.

and Upto my knowledge, we didn’t setup these two servers with forwarders or any splunk setup.

So how we can find out original servers which are sending logs to indexer ?

Tags (2)
0 Karma
Highlighted

Re: Identify IP address from host

SplunkTrust
SplunkTrust

If you browse the syslog, you should be able to see host field. You can get IP of the server by doing nslookup.

0 Karma
Highlighted

Re: Identify IP address from host

Super Champion

If you have configured Splunk to listen to udp:514, then you did configure Splunk to collect data on any server that sends syslog data on udp:514.

0 Karma
Highlighted

Re: Identify IP address from host

Champion

Use Deploy Monitor app(All Forwarder View) for checking which are the forwarders sending data.

In inputs.conf mention the ip address which should only be accepted from.

acceptFrom = <network_acl> ...
* Lists a set of networks or addresses to accept connections from.
 These rules are separated by commas or spaces
* Each rule can be in the following forms:
*   1. A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3")
*   2. A CIDR block of addresses (examples: "10/8", "fe80:1234/32")

Thanks

0 Karma