I have a Linskys SPA-1001 ATA adapter for VOIP. I am wanting to trap a problem where it stops receiving calls and and have enlisted the help of Splunk to see if I can get it to log the syslog files.
From the Linksys Manual:
"How do I debug my SPA? Is there a syslog?
SPA sends out debug information via syslog to a syslog server. The ports can be configured (by default the port is 514).
A. Make sure you do not have firewall running on your PC that could block port 514.
B. On the administration web server System tab, set
number of your syslog server. Note that this address has to be reachable from the Linksys ATA).
C. Also, set
You do not need to change the value of the
D. To capture SIP signaling messages, under the Line tab, set
The file output is syslog.
I have pointed the proper fields in the ATA's pages to point to my server by utilizing my local IP of 192.168.1.140 (where Splunk Lives) . When I try to tell it to listen to UDP 514 it of course says it is in use.
My question then is would I need to tell the SPA to point to: 192.1681.1.140:514 and then Splunk will auto-digest the data being sent at this point without having to set it up to aggregate data from UDP 514? If so, this didn't seem to work.
I just need to capture the debugging data from the ATA. Unfortunately, I can't SSH or SFTP/FTP into the device even though it is an Open Device (Unlocked) as there are no options to allow logins that way to retrieve the log data itself.
Is splunk installed as root? In *nix land you need to have root in order to access ports below 1024..
well you should first try to find out in your splunk box who is listening on 514 and if this cannot be changed setup another port in Splunk then put this port in your linksys device instead of 514.
I do not have anything listening on Port 514 as far as I can tell:
Port Scanning host: 192.168.1.140
Open TCP Port: 88 kerberos
Open TCP Port: 139 netbios-ssn
Open TCP Port: 445 microsoft-ds
Open TCP Port: 631 ipp
Open TCP Port: 3689 daap
Open TCP Port: 8000 irdmi
Open TCP Port: 8089
Open TCP Port: 9102 bacula-fd
Open TCP Port: 17500
Open TCP Port: 27997
I am using Snow Leopard on OSX as well if that helps with anything.