Question : SC4S starts and sends event to Splunk server but doesn't listen on 514

[advissor]

Hi,
SC4S starts and sends event to Splunk server but doesn't listen on 514
netstat doesn't show anything listening on 514

Installed the SC4S on ubuntu 22, disabled syslog-ng (tried enabling/starting - no difference)
As i understand the connector runs as syslog-ng, so i expect it to listen on default ports

Is there any source/config that still has to be added to create the listeners?

Haven't found this part in the docs https://splunk.github.io/splunk-connect-for-syslog/

syslog-ng 4 (4.7.1)
Config version: 4.2

May 19 14:24:04 ip-172-31-91-188 entrypoint.sh[6451]: SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=main for sourcetype=sc4s:fallback...
May 19 14:24:04 ip-172-31-91-188 entrypoint.sh[6451]: SC4S_ENV_CHECK_HEC: Splunk HEC connection test successful to index=main for sourcetype=sc4s:events...
May 19 14:24:04 ip-172-31-91-188 entrypoint.sh[6451]: syslog-ng checking config
May 19 14:24:04 ip-172-31-91-188 entrypoint.sh[6451]: sc4s version=3.25.0
May 19 14:24:04 ip-172-31-91-188 entrypoint.sh[6451]: starting goss
May 19 14:24:04 ip-172-31-91-188 entrypoint.sh[6451]: starting syslog-ng

Thanks!

[ikheifets-splunk]

Hello, @advissor !
What I can propose to check:

1. First of all check that port 514 open for container (you can check port mapping for sc4s container)

2. Check that you haven't firewall on sc4s server or your device that producing log messages, if you have firewall then you need to configure it correctly

3. run echo "<11>Jan 25 17:57:16 10.10.10.2 : %FTD-6-605005: Login permitted from manual/61023 to Sample_Dest_Web:##dest1##/11347 for user sample_user3" | nc 127.0.0.1 514

   where 127.0.0.1 - ip of sc4s server, Jan 25 17:57:16 - date of your log message, please change it on today.
   if new message will appear (in date Jan 25 17:57:16 in example case, don't forget to expand search time range for that) in splunk with sourcetype=cisco:asa, your sc4s server working correctly, check your device setting.

4. Check that you presetuped splunk correctly and you have needed indexes