Open AccessScalable Architectural Pattern for Integrating Syslog Servers with Splunk
Author(s) -
Krishna Mohan Koyya
Publication year - 2021
Publication title -
international journal of recent technology and engineering
Language(s) - English
Resource type - Journals
ISSN - 2277-3878
DOI - 10.35940/ijrte.b6307.0710221
Subject(s) - server , scalability , computer science , event (particle physics) , operating system , analytics , computer network , database , physics , quantum mechanics
An enterprise infrastructure consists of several devices. The devices emit event notifications representing their current state. The devices without storage such as printers and routers are configured to send the event notifications in the form of syslogs to one or more remote syslog servers over the network. Depending on the size and usage of the enterprise infrastructure, millions of syslogs may be emitted per second. These syslogs are used by the system administrators to detect and address the anomalies in the infrastructure. The system administrators often integrate the syslog servers with Log Analysis tools that offer aggregation, analytics, and visualisation capabilities. Splunk is one such popular tool that can be integrated with syslog servers. This paper proposes an architectural pattern for syslog servers that are to be integrated with Splunk for better performance, scalability and resilience.