Getting Data In

rsyslog vs. Splunk Forwarder

csclement
Engager

Hi,

I am wondering what are the pros and cons of the following two logging setups:

  1. All hosts run rsyslog and forward logs to a central server. Install Splunk Forwarder only on the central server and forward logs to Splunk server.
  2. Install Splunk Forward on every host and have logs forward to the Splunk server.

Would appreciate if anyone can share his/her experience. Thanks.

Tags (2)

yannK
Splunk Employee
Splunk Employee

It depends for which logs. I prefer the forwarder for it's flexibility, but syslog has a lower footprint.

  • for syslog logs, with all the same format, you can use the syslog aggregator.
  • for specific logs with specific formats and applications, the splunk forwarder allow you to specify the sourcetype.

  • syslog over udp => not resilient to network issues.
  • splunk forwarder => SSL and caching.

  • deployment of a central syslog => easy
  • deploy and maintain many forwarder => requires tools or deployment server

miteshvohra
Contributor

Additionally, you can throttle bandwidth for sending logs over WAN network using Forwarder which is not otherwise possible.

kristian_kolb
Ultra Champion

And the forwarder can do WinEventLogs far nicer, at least compared to snare. In fact, if there are multi-line log messages, I'd say that's a sign to go with a forwarder.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...