Getting Data In

Secure transport of log files to our Splunk Server

sipapress2go
Engager

How do I secure my log file stream from our primary server to our dedicated Splunk server? Are there any secured layers I can use for the TCP transport?

I have tried to do it with an SSH-tunnel, but when the tunnel breaks down, the next message going through the tunnel is lost.

What do you do?

1 Solution

matt
Splunk Employee
Splunk Employee

Splunk forwarders can encrypt their communication with the indexer using SSL, this can also be used to authenticate the forwarders which will prevent unauthorized forwarders from polluting your index. Documentation on how to configure encryption and authentication of forwarders using SSL can be found here

View solution in original post

matt
Splunk Employee
Splunk Employee

Splunk forwarders can encrypt their communication with the indexer using SSL, this can also be used to authenticate the forwarders which will prevent unauthorized forwarders from polluting your index. Documentation on how to configure encryption and authentication of forwarders using SSL can be found here

dwaddle
SplunkTrust
SplunkTrust

Use a Splunk forwarder, configured in SSL mode. This is considered the best practice.

CerielTjuh
Path Finder

Im not sure if this is what you mean but:

If the primary server is a windows server you could use a splunk forwarder with ssl connection, this will ensure data transport and data integrity. (does not require a extra license, forwarder licenses are free)

If the primary server is not a windows server, try a secure FTP connection to transfer the files to the splunk server.

The first method is approved by our SAS70 compliancy auditors, so should work for you as well 🙂

0 Karma

CerielTjuh
Path Finder

true gkanapathy 😉

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

the splunk forwarder with ssl will work between any two platforms on which splunk runs, which includes most unixes, linux, and windows. rsyslog is fine too, but you're more on your own with respect to setting up matching certificates, etc.

0 Karma

CerielTjuh
Path Finder

Maybe next gen syslog.

Syslog but over a TCP connection.

http://www.debianhelp.co.uk/syslog-ng.htm

0 Karma

sipapress2go
Engager

Both servers run Debian and also I want to be able to follow progress of the primary server in close to realtime (with a delay of max 10 sec.).

Perhaps rsyslog is something I should look into?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...