Splunk Receiving Syslog Mesages via TCP or UDP

[scornish]

All, I'm going to configure Splunk to receive Syslog messages and have not yet decided which transport protocol I will be using.

I'm thinking of just sticking with UDP devices some of my devices may only be able to send messages using UDP.

Besides the normal preferences for TCP over UDP, why is it strongly recommended to configure Splunk to receive Syslog messages via TCP instead of UDP?

Stephanie

[krugger]

I would argue that the preference for TCP is because UDP syslog messages are truncated at around 1K bytes. So if you intend to have long messages coming in via syslog you should chose TCP.

[gkanapathy]

It is not strongly recommended from Splunk to favor TCP over UDP in general. This will be dictated by your own requirements. In cases where delivery of log messages needs to be guaranteed, you will have to use TCP. Similarly, if you need to encrypt the data connection, you should use TCP. However, if (for example) your application logs directly over TCP and the local queue fills up, then your application will block or have to wait to write its own log messages. In many cases, this will be be unacceptable as it will probably cause severe application performance degradation. In such cases, UDP will be preferred.

[Simeon]

The recommendation partially stems from the protocol itself. UDP does not provide guarantee of delivery which can cause data to go missing. Specific to Splunk, the tcp connection will log additional metrics (like source host) within Splunk. When considering connection problems or missing data, the TCP connection is much more desirable.

[Lowell]

You can setup both at the same time. You may also want to consider setting up syslog-ng in front of splunk due to splunk downtime and disk persistence issues. See the following splunk blog for some additional info:

• http://blogs.splunk.com/2008/11/13/syslog-syslog-ng-and-splunk-forwarders/