Knowledge Management

Linux servers - Universal Forwarder or Syslog

dyeo
Engager

What is the best practice to capture data from our *nix servers? Install the Splunk forwarder agent and the Splunk for Unix app which feeds directly to our indexers? I thought a best practice was to have everything syslog-ed before being indexed.

If we only use remote syslog on our servers (not having the Splunk forwarder agent on our servers), I'm assuming we won't get the metrics that the Splunk for Unix app polls for.

Tags (1)
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Typically, we would suggest a Universal Forwarder on the *nix server. This removes any latency that might be introduced by forwarding the syslogs to a syslog server, and also allows you to collect performance data and other logs from the server. The recommendation to use a syslog server is generally for devices or appliances that don't allow for the installation of a forwarder. My rule of thumb is to collect the data at the source whenever possible.

0 Karma

FrankVl
Ultra Champion

Also prevents difficulties with missing timezone information. Hundreds of servers with arbitrary time zone config logging to a central syslog server can be a serious nightmare to deal with if the servers are not including timezone in their syslog message (which in default basic syslog forwarding format is not included).

0 Karma

pruthvikrishnap
Contributor

Hi Dyeo,

This blog is pretty old but will help you decide on which practice is better.

https://www.splunk.com/blog/2011/10/24/choosing-a-forwarder-or-not.html

dyeo
Engager

Thank you; this was very helpful!

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...