splunk for logging syslog traffic over network(tcp)

[randommac]

Hello,

 I am trying to receive syslog messages from another host over the network using tcp. I am receiving periodic messages over udp. But if I remove udp port listening and enable tcp port listening for these syslog messages, I don't receive any. I am using it in a virtual environment. 

Splunk is deployed on a centOS 5 VM that is listening for another linux VM's syslog.

Any suggestions would help.

[Ayn]

This sounds like a configuration issue with the source device rather than a Splunk issue. You need to configure the device to send syslog over TCP. How you do this will vary from device to device (some may not even support sending syslog over TCP), so refer to the device's manual for information on how to do that.

[randommac]

Hi Ayn,

Yes, In the source device apart from the TCP port that splunk is listening on, I haven't made any changes. How do I tell the source device to send syslog over TCP?

[Ayn]

If I understand you correctly you are receiving UDP syslog messages, and when you stop listening for these and instead listen for TCP syslog messages, you are no longer getting the UDP syslog messages? I'm guessing you changed the settings on the source devices too so that they are really sending syslog over TCP, but you're not saying that anywhere. Please confirm.