Getting Data In

Sonicwall 4060 logs

kwandtke
New Member

I'd like to use the SYSLOG feature in the Sonicwall 4060 to send the logs to SPLUNK automatically .. currently I'm dumping the logs into a dir and having SPLUNK watch that .. it works but I'd like to get it to be less manual .. if anybody has done this and could give me some ideas ...

Tags (1)
0 Karma

kwandtke
New Member

Thanks dwaddle,

Not sure what I messed up the first time as I had everything set .. I re-entered everything and the results are coming in .. fantastic

0 Karma

dwaddle
SplunkTrust
SplunkTrust

You should be able to configure your Sonicwall device to send events directly to Splunk acting as a syslog server. The first Google result for "Sonicwall syslog" came back to a Youtube video showing how to enable a Sonicwall to forward to an arbitrary syslog server.

http://www.youtube.com/watch?v=hIof-AV8akQ

There is also this link at Sonicwall's own site:

http://help.mysonicwall.com/sw/eng/705/ui2/23100/Log/Syslog.htm

That covers the Sonicwall side of the question. Now you'll need to configure Splunk to listen on a UDP port for syslog-style messages. That is well covered in the Splunk docs at

http://www.splunk.com/base/Documentation/latest/Admin/Monitornetworkports

Of course, two or three things to look out for in setting this up include:

  • Be sure no other syslog daemon/process is already listening on the port you are trying to use

  • Be sure Splunk has the necessary OS privileges to listen on the UDP port you specify (on Unix, you must be root to listen at less than port 1024 - the default for syslog is 514).

  • Be sure your host firewall (IPTables / Windows Defender / etc) allows the network traffic.

skender27
Contributor

Hi, what sourcetype should I put when I add 514 UDP port in Splunk: syslog?

Skender

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!