Getting Data In

Windows UniversalForwarder not registering Syslog input

pkarpushin
Path Finder

I am trying to make UniversalForwarder on Windows Server 2008 R2 Standard act as a syslog data receiver and forward this data to the Indexer.
It seems that Splunk on this Windows machine does not handle incoming syslog data.
Below is config:
C:\SplunkUniversalForwarder\bin>splunk.exe cmd btool inputs list udp
[udp]
_rcvbuf = 1572864
connection_host = ip
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = Splunk-gtw
index = default
[udp://514]
_rcvbuf = 1572864
connection_host = ip
evt_dc_name =
evt_dns_name =
evt_resolve_ad_obj = 0
host = Splunk-gtw
index = default

C:\SplunkUniversalForwarder\bin>netstat -apb UDP
Active Connections
Proto Local Address Foreign Address State
UDP 0.0.0.0:123 *:

W32Time
[svchost.exe]
UDP 0.0.0.0:514 :
[splunkd.exe]*

I see data in Wireshark capture, but metrics.log shows this:
6-15-2018 13:23:12.395 +0300 INFO Metrics - group=queue, name=udp_queue, max_size_kb=500, current_size_kb=0, current_size=0, largest_size=0, smallest_size=0
06-15-2018 13:23:12.395 +0300 INFO Metrics - group=udpin_connections, *:514, sourcePort=514, _udp_bps=0.00, _udp_kbps=0.00, _udp_avg_thruput=0.00, _udp_kprocessed=0.00, _udp_eps=0.00

Please advise what may be the source of the trouble

0 Karma

lmaclean
Path Finder

Is Splunk running as SYSTEM or as a user and if as a user does it have the required permissions to listen to ports on Windows?

Have you checked splunkd.log when it starts up for "TcpInput" type components and if there are any issues it is reporting?

0 Karma

splkmika1
Explorer

tried running it as the default Windows LocalSystem account, so the permissions I think should be ok. I could also see the Universal Forwarder exe listening on udp 514 with a netstat -a -b.

I've given up on this and just gone with using an external syslog server with a Universal Forwarder installed.
Thanks for your response.

0 Karma

splkmika1
Explorer

Hi, did you ever resolve this issue? I am observing the same issue in my network at the moment.

0 Karma

pkarpushin
Path Finder

No, unfortunately. I had to give up listening 514 udp on my Windows machine, and started monitoring log files on a remote machine instead.

0 Karma

splkmika1
Explorer

no worries. Thanks. Yeah I moved over to monitoring files on a separate syslog server as well.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!