Getting Data In

What is the best practice to send logging from mobile devices to Splunk?

twassing
Engager

Hi everyone,

currently i'm investigating what the best practice is to send logging from mobile devices (Android) to Splunk.
The android devices are logging in the syslog RFC5425 format and are using mutual TLS to send log data. This is because the devices are used in untrusted networks.

I know that the best practice for syslog was to use a dedicated syslog server so receive syslog data. but, as far as i know, the reason for this was that syslog was sending his data over UDP, that is not the case here.

The situation that i am using right now is: android device > syslog-ng > UF > Indexer.
syslog-ng is the log collector that is open to the internet to receive log data.
UF is listening to the saved files and sends it to the indexer.

The question is, am i doing it right? Is there maybe a better way to handle log data from multiple android devices?

Thanks!

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Sounds logical. Also make sure you know about Splunk Mobile Intelligence, or Splunk Mint in case that can help here...I honestly don't know.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi twassing,
you solution is surely correct, there only a delay in indexing because logs are written on a file and then sent to indexers.
I'd like (if possible) to use a Splunk Heavy Forwarder as syslog server and directly send syslogs to indexers.

Remember that it's better to use two HFs and a Load Balancer to avoid single point of failures.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...