Getting Data In

Questions about CentOS rsyslog and Splunk configuration

Explorer

I have a dedicated syslog server running on CentOS6 (rsyslog) which gathers all logs from other servers/devices (stored in a database).

My questions are:
1. Can I install Splunk on same server?
2. What do I need to do to have Splunk as syslog analyzer (and to keep rsyslog as syslog server)?

Thanks

Tags (3)
1 Solution

Splunk Employee
Splunk Employee

You'll need to have rsyslog send a copy to Splunk and a copy into the database. This isn't hard to do with rsyslog.

You could send directly to a Splunk TCP input using:

*.* @@centralserver.example.net

in addition to your database configuration.

Alternatively, have the files written to disk and to your database, and then just have Splunk read those log files.

Splunk automatically parses syslog formatted logs, so you can just send it directly or have it read the files directly.

That's it. 🙂

View solution in original post

Splunk Employee
Splunk Employee

You'll need to have rsyslog send a copy to Splunk and a copy into the database. This isn't hard to do with rsyslog.

You could send directly to a Splunk TCP input using:

*.* @@centralserver.example.net

in addition to your database configuration.

Alternatively, have the files written to disk and to your database, and then just have Splunk read those log files.

Splunk automatically parses syslog formatted logs, so you can just send it directly or have it read the files directly.

That's it. 🙂

View solution in original post

Explorer

OK, got it fixed. There were two issues:

1) to use local IP instead a domain 'localhot'
2) Line *.* @@127.0.0.1 must be added after a line with saving to the DB (as a primary logs storage)

0 Karma

Explorer

Well, I have added

*.* @@localhost

to the rsyslog config and it looks like is not gathering any data (wrong syntax?) neither Syslog seeing anything from syslog (added TCP listening on port 514)

Any clue?

Thanks

0 Karma

Explorer

@@centralserver.example.net is this a location of the server where is Splunk located? Is this not going to loop because is this on same server or it will be parallel connection?

Current rsyslog config connection looks like:
*.* :ommysql:127.0.0.1,rsysdb,user,pass

0 Karma