Knowledge Management

Linux servers - Universal Forwarder or Syslog

dyeo
Engager

What is the best practice to capture data from our *nix servers? Install the Splunk forwarder agent and the Splunk for Unix app which feeds directly to our indexers? I thought a best practice was to have everything syslog-ed before being indexed.

If we only use remote syslog on our servers (not having the Splunk forwarder agent on our servers), I'm assuming we won't get the metrics that the Splunk for Unix app polls for.

Tags (1)
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Typically, we would suggest a Universal Forwarder on the *nix server. This removes any latency that might be introduced by forwarding the syslogs to a syslog server, and also allows you to collect performance data and other logs from the server. The recommendation to use a syslog server is generally for devices or appliances that don't allow for the installation of a forwarder. My rule of thumb is to collect the data at the source whenever possible.

0 Karma

FrankVl
Ultra Champion

Also prevents difficulties with missing timezone information. Hundreds of servers with arbitrary time zone config logging to a central syslog server can be a serious nightmare to deal with if the servers are not including timezone in their syslog message (which in default basic syslog forwarding format is not included).

0 Karma

pruthvikrishnap
Contributor

Hi Dyeo,

This blog is pretty old but will help you decide on which practice is better.

https://www.splunk.com/blog/2011/10/24/choosing-a-forwarder-or-not.html

dyeo
Engager

Thank you; this was very helpful!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...