Getting Data In

syslog

surekhasplunk
Communicator

How to know on which port my syslog data is coming from 

Labels (1)
Tags (1)
0 Karma

thambisetty
Super Champion

It would be nice if you had Shared more details to get better answers. 

which syslog are you talking about?

are you talking about rsyslog/syslog-ng?

are you talking about Splunk Enterprise Network inputs?

 

————————————
If this helps, give a like below.
0 Karma

surekhasplunk
Communicator

Hi @thambisetty ,

Here am talking about rsyslog inputs. 

I have declared the ports in rsyslog.conf file for different input types which gets stored under /app/logs folder.

 

Thanks

 

 

0 Karma

rabbidroid
Path Finder

Do you mean you tell rsyslog to listen on multiple ports, and write data from specific ports to a specific file?

If its TCP you should see a connection in  netstat from that host, and you would see what port it's connected to. Or you can use tcpdump to see the traffic. However netstat and tcpdump will not be very useful if you use a load-balancer to send the traffic. In that case, something like ngrep would be more useful.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

there are lot of different ways how to configure rsyslog to receive events from other nodes and stores those to local file system or sends those directly to splunk (with or without metadata like sourcehost, source, sourcetype etc. information). You could also use “useACK” feature to ensure that no events have lost even splunk goes down e.g. for maintenance. In those cases rsyslog just spool events to queues and start sendings those when splunk nodes are up again.

It’s up to you how you will configure that, one ore more listening ports etc.

You could send several billions events per day (terabytes ingested) without losing any events with this way. 

r. Ismo

0 Karma

thambisetty
Super Champion

Default syslog port is 514 (udp/tcp).

Your syslog server might be receiving events on port 514.

you can test this if you are sure of any source sending logs to syslog server.

for example you know that server A is sending logs to syslog server B.

you can run tcpdump on server B to see on which port events are received.

tcpdump syntax is as below:

tcpdump -vvv -i “yourinterface ame” srcip

 

and look for messages, you would see ip:port of server A and ip:port of serverB.

 

————————————
If this helps, give a like below.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

When you are saying "coming from" are you meaning the listening port of your splunk server or sending port of client?

If first one then e.g.

  • splunk list tcp
  • splunk list udp 

show the ports which splunk is listening. Based on that you could found those e.g 

  • splunk btool inputs list tcp --debug
  • splunk btool inputs list udp --debug

r. Ismo

0 Karma

alonsocaio
Contributor

Hi,

 

Are you using a syslog server or TCP/UDP inputs from Splunk?

 

If you are using TCP or UDP inputs directly on Splunk your source field should show tcp:PORT or udp:PORT (unless you override the source for your inputs).

 

If you are using a syslog server to receive your data, I would suggest you to check configuration files and ports that are listen on the server (if you have access to this server). One other think you could check is the source of your data, since It must have some forwarding configuration to a specific host and port.

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...