Getting Data In

Is it possible to manage syslog-ng.conf using a deployment server?

Path Finder

I am currently managing 4 syslog servers using syslog-ng. I am trying to figure out the best way to manage the syslog-ng.conf file to prevent myself from having to make the same changes in 4 different locations.

Path Finder

I was thinking about this today.. I wonder if this would work using the deployment server?

  1. On the deployment server, /etc/deployment-apps, create a folder syslogng_config with subfolders metadata and local, just like you would for a real Splunk app.
  2. Add another subfolder called "config" or something that Splunk doesn't use. Inside it, add your syslog-ng config file variables in a file, and reference the path in the 'real' syslog-ng.conf file. Ref:
  3. On your deployment server "Forwarder management", add your new app as normal.

As long as the file/folder permissions are good between Splunk and Syslog-NG, I would think this will work..

0 Karma

Path Finder

It worked!!

At the very top of the syslog-ng.conf file, I added a statement:

@include "/opt/splunkforwarder/etc/apps/syslogng_config/*.conf"

Likely because I'm editing the file in Windows and deploying to linux, there were some syntax errors with missing spaces - identified with the command

syslog-ng --syntax-only
The output from that shows that there was a syntax error, but also where it pulled it from (my deployment server path)

After that, reloading the syslog-ng config made the new, managed config go live.

Hope this helps!

0 Karma


For example using puppet. There are many modules, this one was published by a former syslog-ng upstream developer and manages tens of thousands of machines:

Path Finder

Thanks for the info. Was hoping there was a way to do it painlessly with the deployment server. I will look into either puppet or ansible.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...