Getting Data In

Questions about CentOS rsyslog and Splunk configuration

InteractM
Explorer

I have a dedicated syslog server running on CentOS6 (rsyslog) which gathers all logs from other servers/devices (stored in a database).

My questions are:
1. Can I install Splunk on same server?
2. What do I need to do to have Splunk as syslog analyzer (and to keep rsyslog as syslog server)?

Thanks

Tags (3)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

You'll need to have rsyslog send a copy to Splunk and a copy into the database. This isn't hard to do with rsyslog.

You could send directly to a Splunk TCP input using:

*.* @@centralserver.example.net

in addition to your database configuration.

Alternatively, have the files written to disk and to your database, and then just have Splunk read those log files.

Splunk automatically parses syslog formatted logs, so you can just send it directly or have it read the files directly.

That's it. 🙂

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

You'll need to have rsyslog send a copy to Splunk and a copy into the database. This isn't hard to do with rsyslog.

You could send directly to a Splunk TCP input using:

*.* @@centralserver.example.net

in addition to your database configuration.

Alternatively, have the files written to disk and to your database, and then just have Splunk read those log files.

Splunk automatically parses syslog formatted logs, so you can just send it directly or have it read the files directly.

That's it. 🙂

--
Jesse Trucks
Minister of Magic

InteractM
Explorer

OK, got it fixed. There were two issues:

1) to use local IP instead a domain 'localhot'
2) Line *.* @@127.0.0.1 must be added after a line with saving to the DB (as a primary logs storage)

0 Karma

InteractM
Explorer

Well, I have added

*.* @@localhost

to the rsyslog config and it looks like is not gathering any data (wrong syntax?) neither Syslog seeing anything from syslog (added TCP listening on port 514)

Any clue?

Thanks

0 Karma

InteractM
Explorer

@@centralserver.example.net is this a location of the server where is Splunk located? Is this not going to loop because is this on same server or it will be parallel connection?

Current rsyslog config connection looks like:
*.* :ommysql:127.0.0.1,rsysdb,user,pass

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...