Security

best practices for logging

jalfrey
Communicator

I'm setting up logging with Sonicwall firewalls. They support syslog. Do I send it to syslog on a linux system or send it directly to splunk via a port? If I setup multiple firewalls to log the same instance and I use the system syslog do I separate the log files in the syslog configuration?

Tags (2)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

You can send your syslog events directly to Splunk. Just setup up a UDP input (default port 514 for syslog) or a non default port if you wish.

You'll then be able to search and categorize your syslog events in Splunk based on which host (sonic firewall) they came from, or any other fields in the syslog event that identify the origin.You can also dynamically set the source and sourcetype or route the syslog events to different indexes when everything is coming in over the same UDP port using entrys in transforms.conf.

View solution in original post

Damien_Dallimor
Ultra Champion

You can send your syslog events directly to Splunk. Just setup up a UDP input (default port 514 for syslog) or a non default port if you wish.

You'll then be able to search and categorize your syslog events in Splunk based on which host (sonic firewall) they came from, or any other fields in the syslog event that identify the origin.You can also dynamically set the source and sourcetype or route the syslog events to different indexes when everything is coming in over the same UDP port using entrys in transforms.conf.

dshpritz
SplunkTrust
SplunkTrust
0 Karma

jalfrey
Communicator

Thanks that worked great.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...