Configuring Splunk for SonicWall (Linux)

Configuring Splunk for SonicWall (Linux)

1)  Setting up the server to receive syslogs

• Install rsyslogd using "yum install rsyslog"
• Edit file /etc/sysconfig/rsyslog and change the line SYSLOGD_OPTIONS="-m 0"  to SYSLOGD_OPTIONS="-r -m 0"  to accept syslogs from remote systems
• Stop syslog using "service syslog stop"
• Start rsyslogd using "service rsyslog start"

2) Configure the SonicWall to send syslog to this server.

• Login to the SonicWall management GUI.
• Navigate to Log > Syslog page.
• Click on the add button under Syslog Servers.
• Add the IP/Hostname of the syslog server and click OK

3) Install splunk on the server

• Download splunk install file (  wget -O splunk-5.0-140868.i386.rpm 'http://www.splunk.com/page/download_track?file=5.0/splunk/linux/splunk-5.0-140868.i386.rpm&ac=&wget=true&name=wget&typed=releases')
• Install the package using rpm -Uvh splunk-5.0-140868.i386.rpm
• Start the service using /opt/splunk/bin/splunk start
• Open a browser to http://:8000
• Login using admin & changeme
• Click on "Add Data" link on the webpage

• On the next page, Click on "From Files & Directories" under "Or choose a data source"

• On this page, check the skip preview and click on continue

• On the next page, enter the path to the data directory, which is the default directory rsyslog uses(/var/log) and click on save

• A success page comes up and gives you option to search your data now.