|
I'm always nervous about sending plain text syslogs around the place, and rsyslog has some fantastic options (SSL and TLS). Does splunk support reading these connectors, or would I have to setup a client / forwarder setup on the local box to do this? I am not talking about a secured tunnel here. |
|
Splunk does support a TCP w/ SSL input. See http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf . I have no experience to say how well this works with an rsyslog SSL sender. It does, not, however, support syslog via UDP and DTLS. But, I don't think rsyslog can do this either (I may be wrong there). Best practice (and my personal preference) is to still install a forwarder. It can definitely do SSL to Splunk, and can also support scripted inputs and other non-syslog data coming from those machines. |
