Testing syslog-ng on CentOS 8

Question

I am relatively new to Linux and networking but was tasked with the following at work: I built up a CentOS VM machine ( using VirtualBox) on which I had to install Splunk Heavy Forwarder and syslog-ng. The idea is that syslog-ng will listen on a port for incoming logs and write them to a file. After that I will ingest these logs in Splunk doing file monitoring on that specific file.

I came to two problems.

1. I am not sure that I configured syslog-ng correctly since I find it difficult to simulate traffic. I was told to try with netcat. What I did was as follows:

• I create /var/log/syslog-ng/testlog.txt file which has the following permissions -rw-r--r--

• My source driver in syslog-ng.conf -

  source s_test { network ( ip("127.0.0.1") transport("tcp") port(2514) ); };

• My destination driver is -

destination d_tests { file ( "/var/log/syslog-ng/testlog.txt" ); };

• My log statement is -

  log { source(s_test); destination(d_test); destination(d_tests); };

• I tried to simulate traffic using nc -q0 127.0.0.1 2514 but it yields error that q is an invalid option for nc.

Any help would be much appreciated. Thank you.

Answer 1

Just create three different sources:

source s_test { network ( ip("127.0.0.1") transport("tcp") port(2514) ); };

source s_test2 { network ( ip("127.0.0.1") transport("tcp") port(2515) ); };

source s_test3 { network ( ip("127.0.0.1") transport("tcp") port(2516) ); };

Also create three destinations and log paths.

You can simulate traffic using the loggen command of syslog-ng.