syslog

[surekhasplunk]

How to know on which port my syslog data is coming from 

[thambisetty]

It would be nice if you had Shared more details to get better answers. 

which syslog are you talking about?

are you talking about rsyslog/syslog-ng?

are you talking about Splunk Enterprise Network inputs?

[surekhasplunk]

Hi @thambisetty ,

Here am talking about rsyslog inputs. 

I have declared the ports in rsyslog.conf file for different input types which gets stored under /app/logs folder.

Thanks

[rabbidroid]

Do you mean you tell rsyslog to listen on multiple ports, and write data from specific ports to a specific file?

If its TCP you should see a connection in  netstat from that host, and you would see what port it's connected to. Or you can use tcpdump to see the traffic. However netstat and tcpdump will not be very useful if you use a load-balancer to send the traffic. In that case, something like ngrep would be more useful.

[isoutamo]

Hi

there are lot of different ways how to configure rsyslog to receive events from other nodes and stores those to local file system or sends those directly to splunk (with or without metadata like sourcehost, source, sourcetype etc. information). You could also use “useACK” feature to ensure that no events have lost even splunk goes down e.g. for maintenance. In those cases rsyslog just spool events to queues and start sendings those when splunk nodes are up again.

It’s up to you how you will configure that, one ore more listening ports etc.

You could send several billions events per day (terabytes ingested) without losing any events with this way. 

r. Ismo

[thambisetty]

Default syslog port is 514 (udp/tcp).

Your syslog server might be receiving events on port 514.

you can test this if you are sure of any source sending logs to syslog server.

for example you know that server A is sending logs to syslog server B.

you can run tcpdump on server B to see on which port events are received.

tcpdump syntax is as below:

tcpdump -vvv -i “yourinterface ame” srcip

and look for messages, you would see ip:port of server A and ip:port of serverB.

[isoutamo]

When you are saying "coming from" are you meaning the listening port of your splunk server or sending port of client?

If first one then e.g.

• splunk list tcp
• splunk list udp 

show the ports which splunk is listening. Based on that you could found those e.g 

• splunk btool inputs list tcp --debug
• splunk btool inputs list udp --debug

r. Ismo

[alonsocaio]

Hi,

Are you using a syslog server or TCP/UDP inputs from Splunk?

If you are using TCP or UDP inputs directly on Splunk your source field should show tcp:PORT or udp:PORT (unless you override the source for your inputs).

If you are using a syslog server to receive your data, I would suggest you to check configuration files and ports that are listen on the server (if you have access to this server). One other think you could check is the source of your data, since It must have some forwarding configuration to a specific host and port.