Security

How to configure a Log4j2 Socket Appender with a TCP-SSL Appender?

apigeek
New Member

I am planning to configure a Log4j2 Socket Appender with a TCP-SSL Appender.

Here is the configuration I see in Log4j2 website.

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="warn" name="MyApp" packages="">
  <Appenders>
    <Socket name="socket" host="localhost" port="9500">
      <JsonLayout properties="true"/>
      <SSL>
        <KeyStore location="log4j2-keystore.jks" password="guessme!"/>
        <TrustStore location="truststore.jks" password="guessme!"/>
      </SSL>
    </Socket>
  </Appenders>
  <Loggers>
    <Root level="error">
      <AppenderRef ref="socket"/>
    </Root>
  </Loggers>
</Configuration>

In this config, what do the Keystore and TrustStore files contain? I don't have these files.

I want to send my logs to Splunk TCP port.

Do I need to create truststore.jks with SSL certs from my Splunk server so that my server trusts Splunk?

What is log4j2-keystore.jks, and where can I download it? Do I need a KeyStore file? What should go in it? Does Splunk need a corresponding public key or trusted certs?

Thanks,
Sanjay

Tags (4)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...