Getting Data In

rsyslog vs. Splunk Forwarder



I am wondering what are the pros and cons of the following two logging setups:

  1. All hosts run rsyslog and forward logs to a central server. Install Splunk Forwarder only on the central server and forward logs to Splunk server.
  2. Install Splunk Forward on every host and have logs forward to the Splunk server.

Would appreciate if anyone can share his/her experience. Thanks.

Tags (2)

Splunk Employee
Splunk Employee

It depends for which logs. I prefer the forwarder for it's flexibility, but syslog has a lower footprint.

  • for syslog logs, with all the same format, you can use the syslog aggregator.
  • for specific logs with specific formats and applications, the splunk forwarder allow you to specify the sourcetype.

  • syslog over udp => not resilient to network issues.
  • splunk forwarder => SSL and caching.

  • deployment of a central syslog => easy
  • deploy and maintain many forwarder => requires tools or deployment server


Additionally, you can throttle bandwidth for sending logs over WAN network using Forwarder which is not otherwise possible.

Ultra Champion

And the forwarder can do WinEventLogs far nicer, at least compared to snare. In fact, if there are multi-line log messages, I'd say that's a sign to go with a forwarder.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!