Getting Data In

Is it possible to manage syslog-ng.conf using a deployment server?

cburgman
Path Finder

I am currently managing 4 syslog servers using syslog-ng. I am trying to figure out the best way to manage the syslog-ng.conf file to prevent myself from having to make the same changes in 4 different locations.

rpquinlan
Path Finder

I was thinking about this today.. I wonder if this would work using the deployment server?

  1. On the deployment server, /etc/deployment-apps, create a folder syslogng_config with subfolders metadata and local, just like you would for a real Splunk app.
  2. Add another subfolder called "config" or something that Splunk doesn't use. Inside it, add your syslog-ng config file variables in a file, and reference the path in the 'real' syslog-ng.conf file. Ref: https://syslog-ng.com/documents/html/syslog-ng-ose-3.14-guides/en/syslog-ng-ose-guide-admin/html/inc...
  3. On your deployment server "Forwarder management", add your new app as normal.

As long as the file/folder permissions are good between Splunk and Syslog-NG, I would think this will work..

0 Karma

rpquinlan
Path Finder

It worked!!

At the very top of the syslog-ng.conf file, I added a statement:

@include "/opt/splunkforwarder/etc/apps/syslogng_config/*.conf"

Likely because I'm editing the file in Windows and deploying to linux, there were some syntax errors with missing spaces - identified with the command

syslog-ng --syntax-only
The output from that shows that there was a syntax error, but also where it pulled it from (my deployment server path)

After that, reloading the syslog-ng config made the new, managed config go live.

Hope this helps!

0 Karma

czanik
Engager

For example using puppet. There are many modules, this one was published by a former syslog-ng upstream developer and manages tens of thousands of machines: https://forge.puppet.com/ihrwein/syslog_ng

cburgman
Path Finder

Thanks for the info. Was hoping there was a way to do it painlessly with the deployment server. I will look into either puppet or ansible.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...