Getting Data In

Is it possible to manage syslog-ng.conf using a deployment server?

cburgman
Path Finder

I am currently managing 4 syslog servers using syslog-ng. I am trying to figure out the best way to manage the syslog-ng.conf file to prevent myself from having to make the same changes in 4 different locations.

rpquinlan
Path Finder

I was thinking about this today.. I wonder if this would work using the deployment server?

  1. On the deployment server, /etc/deployment-apps, create a folder syslogng_config with subfolders metadata and local, just like you would for a real Splunk app.
  2. Add another subfolder called "config" or something that Splunk doesn't use. Inside it, add your syslog-ng config file variables in a file, and reference the path in the 'real' syslog-ng.conf file. Ref: https://syslog-ng.com/documents/html/syslog-ng-ose-3.14-guides/en/syslog-ng-ose-guide-admin/html/inc...
  3. On your deployment server "Forwarder management", add your new app as normal.

As long as the file/folder permissions are good between Splunk and Syslog-NG, I would think this will work..

0 Karma

rpquinlan
Path Finder

It worked!!

At the very top of the syslog-ng.conf file, I added a statement:

@include "/opt/splunkforwarder/etc/apps/syslogng_config/*.conf"

Likely because I'm editing the file in Windows and deploying to linux, there were some syntax errors with missing spaces - identified with the command

syslog-ng --syntax-only
The output from that shows that there was a syntax error, but also where it pulled it from (my deployment server path)

After that, reloading the syslog-ng config made the new, managed config go live.

Hope this helps!

0 Karma

czanik
Engager

For example using puppet. There are many modules, this one was published by a former syslog-ng upstream developer and manages tens of thousands of machines: https://forge.puppet.com/ihrwein/syslog_ng

cburgman
Path Finder

Thanks for the info. Was hoping there was a way to do it painlessly with the deployment server. I will look into either puppet or ansible.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...