Splunk HF Stops Receiving Fortigate WAF Logs via Syslog Intermittently

[refahiati]

Hello everyone,

I'm currently collecting logs from a Fortigate WAF using Syslog, but I've encountered an issue where, after running smoothly for a while, the Splunk Heavy Forwarder (HF) suddenly stops receiving and forwarding the logs. The only way to resolve this is by restarting the HF, after which everything works fine again, but the problem eventually recurs.

Could anyone advise on:

• Possible causes for this intermittent log collection issue
• Any specific configurations to keep the Syslog input stable
• Troubleshooting steps or recommended best practices to prevent having to restart the HF frequently
• Any insights or similar experiences would be much appreciated!

Thank you!

[kiran_panchavat]

@refahiati  Are you experiencing high resource usage on the Splunk Heavy Forwarder? If so, I suggest configuring syslog-ng or rsyslog on the Heavy Forwarder to collect logs and store them in a separate directory. You can then monitor that directory to forward the events to Splunk indexers. Additionally, review the queues in the metrics.log file for any potential issues. 

[isoutamo]

Have you configured tcp input in HF or are you using separate syslog (like rsyslog or syslog-ng) to receiving those? If you are using HF then just add real syslog server and collect logs from local files.