I'm currently collecting logs from a Fortigate WAF using Syslog, but I've encountered an issue where, after running smoothly for a while, the Splunk Heavy Forwarder (HF) suddenly stops receiving and forwarding the logs. The only way to resolve this is by restarting the HF, after which everything works fine again, but the problem eventually recurs.
Could anyone advise on:
Possible causes for this intermittent log collection issue
Any specific configurations to keep the Syslog input stable
Troubleshooting steps or recommended best practices to prevent having to restart the HF frequently
Any insights or similar experiences would be much appreciated!
