We have a Universal Forwarder on a Domain Controller (DC) that is forwarding all the local logs to a 4.1.7 Forwarder. The 4.1.7 Forwarder is then sending the logs to an Indexer, as well as an IDS via syslog. This 4.1.7 Forwarder is also collecting tons of WMI logs which are being observed on both the Indexer and IDS.
We are seeing the DC logs come across to the indexer however we are not seeing any of the DC logs go to the IDS. As the Universal Forwarder sends cooked data I tried setting cooked data to false:
This is the Universal Forwarder config. /etc/system/local/outputs.conf
After this change I was still able to observe DC logs on the Indexer however none on the IDS. For troubleshooting purposes i installed a LightForwarder on the DC and was able to see DC logs on both the Indexer and the IDS. This leads me to believe that the data is getting cooked by the Universal Forwarder. Anyone have any ideas on how to make the Universal Forwarder send data unCooked or see what im doing wrong here?
Here is the config on the 4.1.7 Forwarder /etc/system/local
An upgrade resolved the issue.
answered 22 Sep '11, 12:41
Have you tried the following stanza in outputs.conf?
I am just basing that off the documentation for forwarding data found here. I am not entirely certain how you want to send data but if its a subset of syslog data then you may be interested in the section near the end (found here)
answered 13 Apr '11, 19:08