I'd like to use the SYSLOG feature in the Sonicwall 4060 to send the logs to SPLUNK automatically .. currently I'm dumping the logs into a dir and having SPLUNK watch that .. it works but I'd like to get it to be less manual .. if anybody has done this and could give me some ideas ...
Thanks dwaddle,
Not sure what I messed up the first time as I had everything set .. I re-entered everything and the results are coming in .. fantastic
You should be able to configure your Sonicwall device to send events directly to Splunk acting as a syslog server. The first Google result for "Sonicwall syslog" came back to a Youtube video showing how to enable a Sonicwall to forward to an arbitrary syslog server.
http://www.youtube.com/watch?v=hIof-AV8akQ
There is also this link at Sonicwall's own site:
http://help.mysonicwall.com/sw/eng/705/ui2/23100/Log/Syslog.htm
That covers the Sonicwall side of the question. Now you'll need to configure Splunk to listen on a UDP port for syslog-style messages. That is well covered in the Splunk docs at
http://www.splunk.com/base/Documentation/latest/Admin/Monitornetworkports
Of course, two or three things to look out for in setting this up include:
Be sure no other syslog daemon/process is already listening on the port you are trying to use
Be sure Splunk has the necessary OS privileges to listen on the UDP port you specify (on Unix, you must be root to listen at less than port 1024 - the default for syslog is 514).
Be sure your host firewall (IPTables / Windows Defender / etc) allows the network traffic.
Hi, what sourcetype should I put when I add 514 UDP port in Splunk: syslog?
Skender