After the upgrade to Splunk 5.0.3, my syslog data sources suddenly stopped to work. Using MS Network Monitor and Wireshark, I am able to see syslog packets reaching the server. Upgrading to 5.0.4 did not resolve the issue.
Splunk is installed on a Windows 2008 R2 machine.
Anyone experiencing the same problem?
Can you verify your inputs? Did you make changes in a default/inputs.conf file? They may have been overwritten. Does the input appear in the manager?
Hi alacercogitatus, thank you for your answer. I never change conf files in "default" folders. The input appears in the manager. In addition, I tried to install a syslog server (temporary disabling the input source) and syslog messages were traced correctly.
It seems that Splunk is refusing to collect data for this data source.
I found the problem. The same day of the update, a configuration change had been made in props.conf (under ./etc/system/local). A stanza had been created to match data sent by three specific hosts (just say: serverA, serverB and serverC). There was a typo in this stanza name! It had been defined as:
The double "||" caused a "match-all" situation. In addition, this stanza has a conditional redirect of all the events, with the exception of the required ones, to the null queue. All the syslog events, as a result, were discarded!