Getting Data In

Will Heavy Forwarder buffer logs, when sending to syslog-out?

FranzB
Engager

Hey Guys,

I set up a Heavy Forwarder atm and just asking myself if a heavy forwarder will buffer the local logs when sent via the syslog-output in the outputs.conf. My config look like this:

[tcpout]

defaultGroup = Target-IP,Target-IP2

indexAndForward = 0

useACK=true

[syslog:Target-IP of Indexer]

server = Target-IP of Indexer

indexAndForward=false

Regarded to the Outputs.conf manual of Splunk there is no option to enable active buffering when using syslog-output

If now the Indexer goes down, will the HF buffer the logs on the local disk and send to it when online again, or will they be dropped?

Thanks for response

0 Karma

sciurus
Path Finder

You should only be using syslog outputs when sending to a non-Splunk server. If you're going to a Splunk indexer, use a configuration more like:

[tcpout]

defaultGroup = output_fwd

[tcpout:output_fwd]

server = 1.2.3.4:9997

useACK = true

syslog-udp will definitely lose data, and syslog-tcp will probably lose the last few messages before the TCP session closes (because it's impossible for Splunk to know what has actually been received), and then buffer it until a new TCP session is established.

0 Karma

german023
New Member

Hey,

thanks for response, but unfortunately the indexer i send the data to, is a non-Splunk indexer. Are there still possibilities to cache/buffer the data?

But given to your answer, whats the difference between "syslog-out" and "tcp:out"?(I configured it via a manual from the third-party system, so i acutally dont know it 😄 )

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...