Getting Data In

Syslog vs Forwarders

bpladna81
Engager

If I have an environment with an rsyslog collection server that is working just fine and collecting from thousands of endpoints, should I keep that or get rid of that and collect events using a UF on each endpoint?

0 Karma

woodcock
Esteemed Legend

You will always need a syslog server but there are many good reasons to go with syslog-ng. I would not make this change unless you frequently need to adjust what is sent and you cannot admin directly. With UFs/DS you can admin all of your splunk configurations by yourself

0 Karma

MuS
Legend

Hi bpladna81,

Keep your rsyslog server for the syslog collection and install an universal forwarder on the same server to monitor the files the rsyslog server creates. Some good background information is available here http://www.georgestarcher.com/splunk-success-with-syslog/

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...