Splunk and Cisco Firepower Audit Logs

[b17gunnr]

Hello folks,

My organization is struggling with ingesting the Cisco Firepower audit (sys)logs into Splunk, we've been able to successfully ingest all the other sources. With the Firepowers only offering up 514udp which is unavailable according to Splunk, or a HEC configuration without tokens so Splunk is (would?) drop the events our option appear limited. Has anyone else come across this issue and solved it?

  

[livehybrid]

Hi @b17gunnr 

The error "UDP port 514 is not available" typically means that Splunk is not able to listen to the port, which is typically for 1 of 2 reasons:

1. Another process is already listening to the port
   Confirm that nothing is already using this port, this process will vary between different OS.
   
   
2. Splunk does not have permissions to listen to port 514.
   To listen to ports <1024 the Splunk process may require additional permissions (CAP_NET_BIND_SERVICE) and/or could be affected by AppArmor / SELinux. This will also vary depending on OS. 

For more information check out https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports  

Also, theres a previous Splunk answer which might help at https://community.splunk.com/t5/Getting-Data-In/how-to-listen-to-port-UDP-514-when-splunk-is-not-roo...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[b17gunnr · Accepted solution]

Unfortunately neither of these were the cause. In the end I believe we're going to set up an intermediate VM with a UF to catch the logs from the Firepowers on udp514. Clunky but it appears to be the only option. I appreciate the help.

[PickleRick]

Also remember that while Splunk can listen for syslogs this is not a recommended setup. It's relatively ok for a small lab deployment but in production you'd rather want to go for a separate syslog daemon either writing to local files for pick up by UF or sending to HEC input.