rsyslog vs. Splunk Forwarder

[csclement]

Hi,

I am wondering what are the pros and cons of the following two logging setups:

1. All hosts run rsyslog and forward logs to a central server. Install Splunk Forwarder only on the central server and forward logs to Splunk server.
2. Install Splunk Forward on every host and have logs forward to the Splunk server.

Would appreciate if anyone can share his/her experience. Thanks.

[yannK]

It depends for which logs. I prefer the forwarder for it's flexibility, but syslog has a lower footprint.

• for syslog logs, with all the same format, you can use the syslog aggregator.
• for specific logs with specific formats and applications, the splunk forwarder allow you to specify the sourcetype.

---

• syslog over udp => not resilient to network issues.
• splunk forwarder => SSL and caching.

---

• deployment of a central syslog => easy
• deploy and maintain many forwarder => requires tools or deployment server

[miteshvohra]

Additionally, you can throttle bandwidth for sending logs over WAN network using Forwarder which is not otherwise possible.

[kristian_kolb]

And the forwarder can do WinEventLogs far nicer, at least compared to snare. In fact, if there are multi-line log messages, I'd say that's a sign to go with a forwarder.