If you are not using trusted SSL certificates, be sure to NOTE: Splunk Connect for Syslog defaults to secure configurations. Consult the community if you feel the number of workers (threads) should The default number of SC4S_DEST_SPLUNK_HEC_WORKERS is 10. Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog. Do not configure HECĪcknowledgement when deploying the HEC token on the Splunk side the underlying syslog-ng http destination does not support thisįeature.
#DOCKER FOR MAC COMPOSE VERSION UPDATE#
Update SC4S_DEST_SPLUNK_HEC_DEFAULT_URL and SC4S_DEST_SPLUNK_HEC_DEFAULT_TOKEN to reflect the correct values for your environment. # SC4S_DEST_SPLUNK_HEC_DEFAULT_TLS_VERIFY = no # Uncomment the following line if using untrusted SSL certificates SC4S_DEST_SPLUNK_HEC_DEFAULT_URL = https: // splunk. opt/sc4s/env_file and add the following environment variables and values: SC4S is almost entirely controlled through environment variables, which are read from a file at starteup. Failure to do this will cause SC4S to abort at startup. IMPORTANT: When creating the directories above, ensure the directories created match the volume mounts specified in theĭocker-compose.yml file (if used). (if the optional mount is uncommented above). This will be used as a mount point for custom TLS certificates
#DOCKER FOR MAC COMPOSE VERSION ARCHIVE#
See the “configuration”ĭocument for details on the directory structure the archive uses.Ĭreate the subdirectory /opt/sc4s/tls. The events will be written in the syslog-ng EWMM format.
This will be used as a mount point for local storage of syslog events splunk_metadata.csv) the changesĬreate the subdirectory /opt/sc4s/archive. In the local/context directory, if you change the “non-example” version of a file (e.g. They will get overwritten at each SC4S start. These should not be used directly,īut copied as templates for your own log path development. To get you started, there is an example log path template ( )Īnd a filter ( nf) in the log_paths and filters subdirectories, respectively. That are not provided out of the box in SC4S.
In the local/config/ directory there are four subdirectories that allow you to provide support for device types See the notes below for which files will be preserved on restarts. To read the local configurations properly. The files that are laid down change (or add) only individual files if desired. Of SC4S for local configurations and context overrides. The empty local directory created above will populate with defaults and examples at the first invocation This will be used as a mount point for local overrides and configurations. See the “SC4S Disk Buffer Configuration” section on the Configruation page for more info.Ĭreate the subdirectory /opt/sc4s/local. var/lib/docker/volumes/ and could grow significantly if there is an extended outage to the SC4S destinations NOTE: Be sure to account for disk space requirements for the docker volume created above. Sudo docker volume create splunk - sc4s - var
0 kommentar(er)
