How to set up syslog input in a indexer cluster for the Barracuda NG Firewall app?

[brent_weaver]

Hello all.

I need to use the Barracuda NG Firewall app (see instructions below) and it looks like I need to set up a syslog input for this. Where do I set this up in an indexer cluster? Do I do it on all the indexer servers as they are configured to be round-robin DNS....

Steps
1. Install the Barracuda NG Firewall Splunk App on your Splunk Server. For more information, see http://docs.splunk.com/Documentation/PCI/2.1.1/Install/InstalltheAppManually
2. Send me Loghost IP Address, Loghost Port – Enter 5140 for plaintext or 5141 for SSL-encrypted connections.
The Barracuda NG Firewall app can only process syslog data that is received on port 5140 (not encrypted) or 5141 for SSL-encrypted connections.
Transmission Mode – UDP/TCP
3. The Splunk server must be configured to receive the syslog data. Verify that you have a Data input entry for TCP or UDP port 5140 or TCP port 5141 (SSL) that listens for the incoming syslog streaming connections. You must use port 5140/5141 because the Barracuda NG Firewall Splunk app can only process data received on these ports. For more information, see http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Monitornetworkports

Any help is much appreciated!

[alacercogitatus]

So, that App is not following best practices for consuming syslog data. This is a really good article on syslog and splunk. http://www.georgestarcher.com/splunk-success-with-syslog/ . Please read it and consume the syslog into Splunk using syslog-ng or rsyslogd. The important part of this is what the documentation for the App states: " The Barracuda NG Firewall app can only process syslog data that is received on port 5140 (not encrypted) or 5141 for SSL-encrypted connections. ". While this is technically true, if you look at the configurations behind it, they are transforming all the syslog into a single sourcetype.

So in your inputs.conf on the Syslog Collection server (that you setup according to the article above), you will need to specify this sourcetype: fw_act. That is the actual sourcetype that the dashboards use. So any way you get the syslog data into Splunk (read the article), make sure the sourcetype of the Barracuda data you require is fw_act.

[brent_weaver]

So i just lost the battle to get a remote syslog server. My arch is as such:

1 Lic Server
1 Deployment Server
1 Master INdex Server
4 Index CLustered servers
1 isolated seach head with ES and barracuda installed on it
3 Node search head

Where do I configure the syslog listener, port 5040 and port 5141? Is this done on the search head? Also given that we are a index cluster, will this index only be written on one of the index servers?

Thanks for the help!