Is it possible to send Syslog data to a forwarder instead of an indexer?

[bread555]

I am using Suricata IDS to send Syslog data to an indexer. However, due to some overload (and very noisy Suricata) I wanted to shift that to sending it instead to a forwarder (preferably a local forwarder). Is that possible?

[grijhwani]

There are lots (well at least a couple) of good reasons for running a separate syslog capture process.

Firstly, irrespective of the choice of syslog server you don't lose log data on those occasions when the Splunk service has to be restarted. Syslog is by default UDP, and volatile. If you fail to capture it it is gone. Having a separate server ensures that the syslog capture is continuous, even if the forwarding is interrupted.

Secondly, if using syslog-ng the log data can be saved into meaningful hierarchical (user-definable) trees which can then be used further to add a layer of value in the indexing.

[martin_mueller · Accepted solution]

Sure. Best practice is to have a syslog daemon receive the data, write it to a log file, and let a Splunk Universal Forwarder send that file to your indexers.

[bread555]

Well then. Sweet point goodness for you kind sir.

[martin_mueller]

Sure, you can have the UF listen to syslog directly. It can receive network data just like the indexer can.

[bread555]

Thats what I was thinking, but I was hoping there was a way to cut out the middle man of a syslog daemon. If there is no way to do this natively in Splunk I'll give you full and due karma goodness!