Our networking group collects events to their own syslog server and refuse to send the events directly to use from the network devices. We have to use their syslog relay. Wondering, what would be the pros/cons of putting an edge client on their syslog server instead. Could it keep up? The edge client would read from logfiles. Any other considerations?
Solved
What would be the pros/cons of putting an edge client on their syslog server
Best answer by Brendan Dalpe
Edge should be able to handle picking up the files and forwarding to a Stream Worker Group with a passthru pipeline on the Edge side.
Yes
No
The actual answer depends on little details like "how much data are we talking about" 
assuming that I'm just routing this to stream (no processing done at the edge client) - could it handle a couple of hudred gigabytes a day?
We just setup a networking worker group which consumes everything, normalizes things as much as possible before indexing it in splunk. The ciscos/junipers/aristas are all a bit bonkers
Edge should be able to handle picking up the files and forwarding to a Stream Worker Group with a passthru pipeline on the Edge side.
Sign up
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.