I must be missing something very simple here so bear with me.
I am running a Splunk universal forwarder instance, and I would like to forward its internal logs (e.g. splunkd.log) to my own Syslog server.
I would like to do this for my own internal audit logging separate from the indexer that is connected to the forwarder. Is there any support for this?
I have tried to set up rsyslog to watch splunkd.log but there seem to be some inotify shenanigans going on and rsyslog fails to recognize that the log file is being updated.