Sonicwall 4060 logs

[kwandtke]

I'd like to use the SYSLOG feature in the Sonicwall 4060 to send the logs to SPLUNK automatically .. currently I'm dumping the logs into a dir and having SPLUNK watch that .. it works but I'd like to get it to be less manual .. if anybody has done this and could give me some ideas ...

[kwandtke]

Thanks dwaddle,

Not sure what I messed up the first time as I had everything set .. I re-entered everything and the results are coming in .. fantastic

[dwaddle]

You should be able to configure your Sonicwall device to send events directly to Splunk acting as a syslog server. The first Google result for "Sonicwall syslog" came back to a Youtube video showing how to enable a Sonicwall to forward to an arbitrary syslog server.

http://www.youtube.com/watch?v=hIof-AV8akQ

There is also this link at Sonicwall's own site:

http://help.mysonicwall.com/sw/eng/705/ui2/23100/Log/Syslog.htm

That covers the Sonicwall side of the question. Now you'll need to configure Splunk to listen on a UDP port for syslog-style messages. That is well covered in the Splunk docs at

http://www.splunk.com/base/Documentation/latest/Admin/Monitornetworkports

Of course, two or three things to look out for in setting this up include:

• Be sure no other syslog daemon/process is already listening on the port you are trying to use

• Be sure Splunk has the necessary OS privileges to listen on the UDP port you specify (on Unix, you must be root to listen at less than port 1024 - the default for syslog is 514).

• Be sure your host firewall (IPTables / Windows Defender / etc) allows the network traffic.

[skender27]

Hi, what sourcetype should I put when I add 514 UDP port in Splunk: syslog?

Skender