Syslog server - Splunk

[houghtp]

Hi is anyone using Splunk as their Syslog server?

I've got everything set up according to docs but i'm not seeing any logging on the splunk server

so far i've added following to end of syslog.conf

. @

then restarted syslog service

i've opened UDP 514

esxcfg-firewall -o 514,udp,out,syslog

esxcfg-firewall -l

Then in splunk i've configured a network data input to listen on UDP 514 from all hosts.

there are no other firewalls between ESX hosts and splunk server.

but no joy..

I'm using Splunk 3.4.3 46779 on Windows. I've currently got a case open with splunk but as we have no paid support with them its on best endevour, just wondered if anyone else has this working

thanks

[benma]

Hey Buddy,

try the followingin you syslog.conf:

[.@plunkserver]

service syslog restart

[houghtp]

Hi sorry that should say

• . * @ <splunk server>

(star dot star) can't get formatting right in forum?

[benma]

Can you resolv your splunk server from the ESX-Host?

I don't think its needed but try to restart your splunk through the admin page

[houghtp]

Hi

I've confirmed all basic network connectivty . I has also restarted splunk web a few times after configuring the the data input.

thanks

[stevesvt]

I think it should be . port 514" and then try to generate some syslog messages.

. is going to create a ton of syslog messages.

[benma]

<dot><space>@IP

I've selected Set source type: Manual

source type syslog

[dconvery · Accepted solution]

Here's how to set it up -> http://www.splunk.com/base/Community:VMwareESXSyslog

Dave Convery

VMware vExpert 2009

http://www.dailyhypervisor.com

Careful. We don't want to learn from this.

Bill Watterson, "Calvin and Hobbes"

[houghtp]

cheers folks I had configured everything configured along these lines just didn't have syslog.conf configured exactly as it should be

*. * @splunk

had a tab not a space in between * and @ sign all working now.

thanks again.