Splunk Cloud Syslog Logs

[Atriox]

Hello Everyone,

New to splunk in my current role, 

we have had to downgrade our firewall version and switch it to a physical to virtual which changed the mac address on  the firewalls. before this downgrade the logs were coming in but now there stopped,

any help would be appreciated 

[Richfez]

Changing MAC address shouldn't probably affect anything, but changing IP addresses might.

In any case, I'd start with your firewall - how is it configured to send syslog, to what address specifically? Is it actually doing so?  You basically just need to follow the path the data is supposed to take and find out where it's failing.

That may lead directly to Splunk Cloud, with Splunk Cloud listening on a network port.  https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/HowSplunkEnterprisehandlessyslogdata

In that case you might have to adjust the IP allow list in Splunk Cloud.  https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/Config/ConfigureIPAllowList

It's also possible the device is sending its logs to a local syslog server, which has a splunk forwarder installed and which then sends the logs in to Splunk.  If that's the case, then the problem is most likely with the firewall - either as mentioned earlier it's not actually sending syslog, or I guess it's also possible in the firewall swap a rule or two has been missed.

And if that's the case (FW -> syslog locally, Splunk forwarder -> Splunk Cloud) it's not likely anything in the last half of that is broken but you could check for something simple like a forwarder that just got all jammed up and confused and needs a restart.

But as mentioned - start with your firewall's syslog settings and work your way through the syslog data flow and I'm sure you'll find it.

[Atriox]

Hi Ricfez,

sorry i forgot to add more detail to this but no the ip hasn't changed or the hostname of the firewalls, running a tcpdump i can see the logs are hitting my Sc4s(on-prem) to our splunk could instance  , however on the fw themselves the format of the logs were set as "splunk" maybe this could have an effect?