Getting Data In

Syslog + SSL connection logs?

PabloJulian
New Member

Hello All,
I am trying to configure McAfee ePO to send syslogs to Splunk; ePO requires the use of SSL. I've tried to configure an SSL input on port 6514 for TCP - syslog, and followed all the steps found in the web / manuals / etc. but I can't seem to be able to get this to work.

Here's my question: Where can I find logs that show the detail of the SSL negotiation with the remote host, and what is failing?

Thanks all,

Pablo

0 Karma

bcyates
Communicator

Sending syslog directly to Splunk is against best practice. You should send it to a syslog server like Rsyslog or Syslog-ng. Regardless, you would have to install certificates on the receiving host, otherwise handshake will fail.

Check out the answer here: https://answers.splunk.com/answers/658055/setup-secure-encrypted-syslog.html

But the splunkd.log would have any errors. /opt/splunk/var/log/splunk |grep -i error

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...