Getting Data In

Syslog + SSL connection logs?

PabloJulian
New Member

Hello All,
I am trying to configure McAfee ePO to send syslogs to Splunk; ePO requires the use of SSL. I've tried to configure an SSL input on port 6514 for TCP - syslog, and followed all the steps found in the web / manuals / etc. but I can't seem to be able to get this to work.

Here's my question: Where can I find logs that show the detail of the SSL negotiation with the remote host, and what is failing?

Thanks all,

Pablo

0 Karma

bcyates
Communicator

Sending syslog directly to Splunk is against best practice. You should send it to a syslog server like Rsyslog or Syslog-ng. Regardless, you would have to install certificates on the receiving host, otherwise handshake will fail.

Check out the answer here: https://answers.splunk.com/answers/658055/setup-secure-encrypted-syslog.html

But the splunkd.log would have any errors. /opt/splunk/var/log/splunk |grep -i error

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...