Syslog data source and Splunk 5.0.3 on Windows 2008

[mas]

After the upgrade to Splunk 5.0.3, my syslog data sources suddenly stopped to work. Using MS Network Monitor and Wireshark, I am able to see syslog packets reaching the server. Upgrading to 5.0.4 did not resolve the issue.

Splunk is installed on a Windows 2008 R2 machine.

Anyone experiencing the same problem?

[mas · Accepted solution]

I found the problem. The same day of the update, a configuration change had been made in props.conf (under ./etc/system/local). A stanza had been created to match data sent by three specific hosts (just say: serverA, serverB and serverC). There was a typo in this stanza name! It had been defined as:

[host::serverA|host::serverB||host::serverC]

instead of

[host::serverA|host::serverB|host::serverC]

The double "||" caused a "match-all" situation. In addition, this stanza has a conditional redirect of all the events, with the exception of the required ones, to the null queue. All the syslog events, as a result, were discarded!

[alacercogitatus]

Can you verify your inputs? Did you make changes in a default/inputs.conf file? They may have been overwritten. Does the input appear in the manager?

[mas]

Hi alacercogitatus, thank you for your answer. I never change conf files in "default" folders. The input appears in the manager. In addition, I tried to install a syslog server (temporary disabling the input source) and syslog messages were traced correctly.

It seems that Splunk is refusing to collect data for this data source.