Security

Netapp FAS Custom Port Setup

Dan244
New Member

Im trying to setup syslog forwarding on our FAS Netapp filers to a custom port.
I've seen instruction how to setup to the default UDP 514 port... but our splunk admin wants the logs to go to a custom port, lets say 12345. Has anyone setup their filers like this?

Thanks,

Tags (4)
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

NetApp's Data OnTap OS uses a syslog.conf file to configure the syslog daemon. I think you can just use this syntax to forward to a different port on the remote server:

*.*     @remotehost:12345
0 Karma

Dan244
New Member

OK I've added the IP address of my Splunk server to the host file of the filer, logserv.
I'm able to resolve the server from the filer.
changed the syslog.conf file to point to logserv:12345
now i get this message on the filer:
Syslog daemon error logerror syslogd: Couldn't find address for host name "logserv:12345": Unkown resolver error.
syslogd: Restarted
As soon as I change it back to just @logserv it works ok on the standard UDP port 514

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...