Getting Data In

How to setup a Universal Forwarder to forward syslog data from firewall

jbleich
Path Finder

I have a windows 2019 SRV and will be installing splunk forwarder 8.0.4

I have a firewall and I have set the IP of this new server as it's syslog server. It's my understanding that the sonicwall sends this syslog information over port 514.

 

So how do I setup my syslog server w/ the Universal Forwarder to ingest and forward this data on to the indexer. Or do I need to setup a "listener" outside of splunk on the new syslog server to get the data to a log file and then simply use the forwarder to grab that log file and send to indexer?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The original way of doing syslog was to have Splunk listen on TCP and/or UDP port 514, but that's no longer recommended as it can lead to data loss when Splunk restarts.

The long-recommended method is the latter of your thoughts: set up a dedicated syslog listener (often syslog-ng), have it write received data to files, and have Splunk UF monitor those files.  That works pretty well.

The newest method is to use the Splunk Connect for Syslog (SC4S) app.  It creates a syslog-ng server in a container, listens for syslog events, and send them directly to a HEC input on your indexer(s).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

jbleich
Path Finder

Thanks for that info, I'm not "scared" of linux it's just I dont use it a ton so when I have to work on it i have to retrain myself.......are there any options w/ a windows syslog server?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The second and third options in my answer may work on Windows, but I have seen or heard of anyone doing so.  "Windows" and "syslog" usually don't go in the same sentence.  Of course, the instructions are usually written for a Linux server so you'll have to translate everything into Windows-speak.

This may be a good opportunity to strengthen your Linux skills.  Splunk on Windows can be painful at times.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The original way of doing syslog was to have Splunk listen on TCP and/or UDP port 514, but that's no longer recommended as it can lead to data loss when Splunk restarts.

The long-recommended method is the latter of your thoughts: set up a dedicated syslog listener (often syslog-ng), have it write received data to files, and have Splunk UF monitor those files.  That works pretty well.

The newest method is to use the Splunk Connect for Syslog (SC4S) app.  It creates a syslog-ng server in a container, listens for syslog events, and send them directly to a HEC input on your indexer(s).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!