Getting Data In

preserve host name when using a kiwi server to collect logs

JWBailey
Communicator

We have non-windows devices sending their syslog information to a Kiwi server that is hosted on a windows box.
The kiwi server is configured to filter events and write them to individual log files.

We have a universal forwarder installed on the Kiwi server with various apps deployed to the server.
Each app is configured with a local inputs.conf file to monitor a specific log file.

How do I preserve the host information from the original devices and prevent splunk from grabbing the host value from $SPLUNK_HOME\etc\system\local\inputs.conf ?

Currently some of my sourcetypes successfully do this, and the host field contains the IP address of the original device, some of my sourcetypes do not and it is incorrectly showing the Kiwi server name in the host field.

Thank you.

Tags (4)
0 Karma

srioux
Communicator

Had this issue in a previous environment as well. I remember Kiwi not playing nice with a few other systems. As far as I can recall, there were a few ways around it:

  • Don't use Kiwi as a syslog aggregation box (if you have the option of spinning up a *nix box). Whatever flavor you end up using will likely have flexible syslog output configurations (i.e. templates in rsyslog).
  • Make sure you use the appropriate Kiwi settings - there's a few that you may have to play with in order to get it working the way you expect, including "Retain the original source address of the message" and "Spoof Network Packet". Can find more documentation on Kiwi's site.
  • http://www.kiwisyslog.com/help/syslog/index.html?action_forward_to_another_host.htm

I can't speak to the validity of the second solution, since we just ended up putting dedicated RHEL-flavored forwarders in place to capture & send along the messages, and were gradually migrating away from Kiwi.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...