What is the best practice to send logging from mobile devices to Splunk?

[twassing]

Hi everyone,

currently i'm investigating what the best practice is to send logging from mobile devices (Android) to Splunk.
The android devices are logging in the syslog RFC5425 format and are using mutual TLS to send log data. This is because the devices are used in untrusted networks.

I know that the best practice for syslog was to use a dedicated syslog server so receive syslog data. but, as far as i know, the reason for this was that syslog was sending his data over UDP, that is not the case here.

The situation that i am using right now is: android device > syslog-ng > UF > Indexer.
syslog-ng is the log collector that is open to the internet to receive log data.
UF is listening to the saved files and sends it to the indexer.

The question is, am i doing it right? Is there maybe a better way to handle log data from multiple android devices?

Thanks!

[sloshburch]

Sounds logical. Also make sure you know about Splunk Mobile Intelligence, or Splunk Mint in case that can help here...I honestly don't know.

[gcusello]

Hi twassing,
you solution is surely correct, there only a delay in indexing because logs are written on a file and then sent to indexers.
I'd like (if possible) to use a Splunk Heavy Forwarder as syslog server and directly send syslogs to indexers.

Remember that it's better to use two HFs and a Load Balancer to avoid single point of failures.

Bye.
Giuseppe