Getting Data In

Unable to forward syslogs coming in from UDP:514

xrtan
Explorer

Here is my setup on my Heavy Forwarder

inputs.conf

[udp://:514]
sourcetype = syslog
connection_host = ip
disabled = 0
[tcp://:514]
sourcetype = syslog
connection_host = ip
disabled = 0

outputs.conf

[tcpout]
defaultGroup = indexers
[tcpout:indexers]
server = < ip-address >:9997, < ip-address >:9997

However, on my indexers, I'm only able to see source tcp:514. My UDP syslogs are not being indexed.

Any idea where went wrong?

EDIT (resolved):
Just to update, configured my props.conf and solve the issue

Old configuration:
[host::10.1.1.1]
TRANSFORMS-change = change

Corrected configuration:
[source::udp:514]
TRANSFORMS-change = change

Hope this might be useful to anyone who is trying to achieve something similar to what i'm trying

0 Karma

alemarzu
Motivator

Xrtan,

You did not specified index on each input stanza. Did you enable receiving port 9997 on the Indexer ?

0 Karma

xrtan
Explorer

Hi alemarzu, the event are going into default index main. 9997 is enabled on indexer too.
The indexer is indexing events from tcp:514 but not udp:514.

0 Karma

alemarzu
Motivator

Did you tried to search those events directly on the Heavy Forwarder first ? (udp:514)
What about rules on your firewall, did you check them ?

0 Karma

xrtan
Explorer

if i were to use indexandForward it will be able to index, however not able to send out.
Firewall has been turned off. Anyhow, i've figured out what went wrong. Thanks for the help, cheers.

0 Karma

alemarzu
Motivator

Great xrtan, do you mind sharing the answers, it may help other members.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!