Getting Data In

How to monitor HAproxy logs of server in Splunk

rahul2gupta
Path Finder

Hi @gcusello ,

Could you please help me to monitor HA proxy logs of server in Splunk. What should be the steps that needs to be carried out.

Also user is saying that "The HAProxy container is set up with rsyslog, using the omfwd module to forward traffic to the relevant IP address that has been set up in the config."

Regards,

Rahul

 

Labels (3)
0 Karma
1 Solution

gcusello
Legend

Hi @rahul2gupta,

if your proxies send their logs to an rsyslog server, the best approach is to have two rsyslog servers with Splunk Universal Forwarder.

Then you need a Load Balancer to distribute traffic between the two rsyslog servers and manage fail tolerance.

The Load Balancer could be an Hardware Load Balancer (better) or also a DNS configuration to have a virtual address that send logs to the two rsyslog servers.

Then Universal Forwarders reads log files and send logs to Splunk.

Otherwise, you can also use two Heavy Forwarders and use their capabilities to ingest syslogs instead of rsyslog server.

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @rahul2gupta,

if your proxies send their logs to an rsyslog server, the best approach is to have two rsyslog servers with Splunk Universal Forwarder.

Then you need a Load Balancer to distribute traffic between the two rsyslog servers and manage fail tolerance.

The Load Balancer could be an Hardware Load Balancer (better) or also a DNS configuration to have a virtual address that send logs to the two rsyslog servers.

Then Universal Forwarders reads log files and send logs to Splunk.

Otherwise, you can also use two Heavy Forwarders and use their capabilities to ingest syslogs instead of rsyslog server.

Ciao.

Giuseppe

PickleRick
Ultra Champion

I'd have to double-check it but I think DNS-based load balancing will not work with rsyslog.

Anyway, if the HAproxy containers send normal syslog, it just boils down to a typical case of receiving syslog events - be it with rsyslog or sc4s or whatever other solution you want.

Oh, and there is an add-on for HAproxy so the logs should get parsed properly almost out of the box (unless the containerized haproxy massacres them in any way).

0 Karma

rahul2gupta
Path Finder

Thanks @gcusello !

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...