syslog forwarding, how to check if syslog has been sent?

[zugji]

How can I check if syslog messages has been forwarded to another system. Are there some metrics available in metrics.log or somewhere else? What are the follwoing parameter for: avg_udp_throuput, _udp_bps, _udp_eps or _udp_kps?
My configuration for the moment to forward syslog messages looks like the following:

[syslog:localhost_514]
server=localhost:514
type=udp

Regards,
Christian

[nychawk]

Your settings shown on top are a bit strange to me, well the first one at least:
[syslog:localhost_514]
server=localhost:514
type=udp

Where is this setting, "[syslog:localhost_514]" used? If in your syslog, then you need to use a colon, not an underscore, to separate your hostname and port number.

Also, you've stated that you are unable to access the server that is receiving syslog, can you verify that it is even listening?

You can also run tcpdump on the host that is sending, looking to see if traffic is even making it out of your host.

HTH,

-m

[thomrs]

The Splunk Deployment Monitor App is a great way to monitor things. All kinds of OTB searches and alerts you can activate.

One feature lets you know if a change in sourcetype data volume happens.

https://apps.splunk.com/app/1294/

[David]

Yes, those metrics will show you what you're looking for. EPS refers to Events Per Second, Kbps refers to Kilobytes per second transferred. If you're looking more detail, you can always do a Wireshark capture or Tcpdump (depending on whether you're on a windows or Linux platform) that will let you watch the actual traffic going over the wire, but that shouldn't be necessary when you've already found the logs that show Splunk is sending data.

[zugji]

Hi David
Thanks a lot for your answer.
Unfortunatly splunk is running in a Solaris container (zone). So we do not have access to the interface as the interface is in sitting in the global zone and so snoop will not work.

[David]

Understood. Then the logs should provide you the evidence you need. If you're not seeing the data where you expect to, you'll need to track through to find the problem, which usually requires checking each firewall along the way, etc. if you're seeing a decent udp thruput for eps and Kbps, Splunk is sending the data.

[zugji]

ok, all of these parameters are empty resp. 0. That means to me that there is something weird.