Collecting server logs without installing Splunk UF?

[karthi2809]

Hi ,

How to collect server logs without installing the Splunk Universal forwarder. Because the server owned team is not interested to install UF. Please let me know is any other way to collect the data and how?

Thanks,

Karthi

[gcusello]

Hi @karthi2809 ,

are you speking of a Windows or a Linux server?

if Windows you can use WMI : https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWMIdata

if Linux, you can use syslogs:  https://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports

Even if Universal Forwarder is much more efficient anf doesn't give any issue and very trascurable load on the machine.

Ciao.

Giuseppe

[karthi2809]

Hi @gcusello 

I agree that point but our client is not intrested to install agent and as you mentioned the syslog the application team have multiple logs .So is there any ways to monitor the logs .And how to onboard syslogs any examples.

Thanks,

Karthi

[gcusello]

Hi @karthi2809 ,

Linux servers can easily send syslogs, that you can receive directly in Splunk or passing throgh rsyslog or syslog-ng server.

Anyway I continue to hint to try to convince your customer about Universal Forwarders: they are more efficient, secure and you can capture more kinds of logs..

Ciao.

Giuseppe