Set up Syslog as an ingest method
Step 1 - Prepare the LogScale Collector
Install the Falcon LogScale Collector on a host that will receive syslog messages.
Ensure the Collector is configured to listen on the appropriate TCP/UDP ports for syslog (commonly 514)
Step 2 - Configure the syslog source
Edit the Collector's configuration file to define a syslog source. Specify the protocol (TCP/UDP), port, and any filtering or parsing options.
Here's an example YAML snippet:
sources:
type: syslog
protocol: tcp
listen_address: 0.0.0.0
port: 514
parser: syslog
Step 3 - Configure syslog senders
On your source systems (Linux servers, network devices, etc.), configure their syslog daemons (e.g., rsyslog, syslog-ng) to forward logs to the Collector's IP and port.
For example, on Linux (rsyslog):
Edit /etc/rsyslog.conf or /etc/rsyslog.d/*.conf
Add a line like: . @@collector_ip:514
Restart the rsyslog service
Step 4 - Assign an ingest token
In Falcon LogScale, create an ingest token for the repository where syslog data will be stored.
Assign the token in the Collector configuration to authenticate and authorize data ingestion.
Step 5 - Advanced settings configuration
Adjust worker threads for performance (Linux only).
Configure multi-destination sinks if you want to forward syslog data to multiple repositories or external systems.
Set up filtering, field extraction, and custom parsing as needed.
Step 6 - Test and verify
Send test syslog messages from a source system
Confirm data appears in the target repository in Falcon LogScale
Check for parsing accuracy and field extraction
Step 7 - Monitoring and maintenance
Monitor Collector health and syslog input status in Falcon LogScale
Set up alerts for dropped messages or Collector errors
Periodically review Collector and syslog sender configurations for optimal performance and security
Troubleshooting Tips
Ensure network connectivity and firewall rules allow syslog traffic to the Collector
Verify correct protocol (TCP/UDP) and port configuration on both sender and Collector
Check Collector logs for errors or dropped messages Use test utilities (logger, netcat) to simulate syslog traffic during setup
Limitations
The Collector must be reachable from all syslog sources.
High-volume environments might require tuning worker threads and batch settings.
Some network devices might require custom parsing for non-standard syslog formats.