Is it possible to forward logs from UF to Syslog-ng using either BSD/IETF syslog format?

[mohdmikhael]

Hi,

I was posed a query from my customer. Is it possible to forward syslog from UF to Syslog-ng using the BSD/IETF syslog format? If so, how would one go about implementing it?

Thank you in advance for any information provided.

Regards,

Mikhael

[isoutamo]

Hi

Yes it's possible, at least on HF side, but why you don't send all to syslog-ng and then read those by UF from syslog-ng server? That is much better approach than use splunk to deliver syslog.

If you still want to do it by splunk, there are lot of examples on community and docs.splunk.com e..g

https://community.splunk.com/t5/Getting-Data-In/Forwarding-data-from-Heavy-forwarder-to-syslog-serve...

r. Ismo

[PickleRick]

The question was about UF. And on UF it's not possible. Quoting from outputs.conf spec:

# The syslog output processor is not available for universal or light
# forwarders.

Anyway, I suppose it's a case of replacing one solution with another or implementing two different solutions for two different purposes (like Splunk for security and some syslog collector for ops). I'd probably also suggest doing the syslog part first and pass the events to the Splunk layer (either by saving to files and ingesting the files with UF or by pushing them directly to HEC from the syslog server, bypassing UF completely).