Will Heavy Forwarder buffer logs, when sending to syslog-out?

[FranzB]

Hey Guys,

I set up a Heavy Forwarder atm and just asking myself if a heavy forwarder will buffer the local logs when sent via the syslog-output in the outputs.conf. My config look like this:

[tcpout]

defaultGroup = Target-IP,Target-IP2

indexAndForward = 0

useACK=true

[syslog:Target-IP of Indexer]

server = Target-IP of Indexer

indexAndForward=false

Regarded to the Outputs.conf manual of Splunk there is no option to enable active buffering when using syslog-output

If now the Indexer goes down, will the HF buffer the logs on the local disk and send to it when online again, or will they be dropped?

Thanks for response

[sciurus]

You should only be using syslog outputs when sending to a non-Splunk server. If you're going to a Splunk indexer, use a configuration more like:

[tcpout]

defaultGroup = output_fwd

[tcpout:output_fwd]

server = 1.2.3.4:9997

useACK = true

syslog-udp will definitely lose data, and syslog-tcp will probably lose the last few messages before the TCP session closes (because it's impossible for Splunk to know what has actually been received), and then buffer it until a new TCP session is established.

[german023]

Hey,

thanks for response, but unfortunately the indexer i send the data to, is a non-Splunk indexer. Are there still possibilities to cache/buffer the data?

But given to your answer, whats the difference between "syslog-out" and "tcp:out"?(I configured it via a manual from the third-party system, so i acutally dont know it 😄 )