Abdellatif please search on connect for the internal resources available for syslog. 

Archsight syslog server and various other syslog servers are supported

For the rest of the community, we introduced syslog via UDP in 11.20.  Events, alerts, and audit can be forwarded to a syslog server

In 11.23 we introduced syslog over TLS, so you can securely forward events, alerts, and audit.  

Cunningham and I have configured this to FWD to Splunk using both methods.  You can see the results below (might need to click the image to read it)

Thanks MFasulo for the info.

At least I have an idea on how the syslog format is.

I also noticed that this is configurable only from the Command Center. Couldn’t find it on CommCell Java GUI.

I am not very familiar with Connect to find the internal resources but will try to.

Thanks and regards

Abdellatif

No problem, ill send you a message and help you out.

I’m not sure if this made it into Java UI, my primary focus is Command Center  

Guys, I have a question here, does Commvault send logs to syslog(splunk) immediately or are they sent in bulk at certain frequencies?

In my lab, I’m seeing syslog messages arriving every 8 minutes.

Thanks,
Scott
 

@Scott Moseman Isn't there a way to send this continuously, like Commvault Event Viewer.. ? In our environment, this sometimes takes 15-20 minutes.

I confirmed the product is configured for 8 minute intervals.
At this time, to change it, you can open up a Support case.

Thanks,
Scott
 

Thanks @Scott Moseman for the confirmation.

Need some suggestion :

What is the recommended way to configure Commvault logs in Splunk . Which will provide you more control over the logs .

1. To use Commvault Splunk app https://splunkbase.splunk.com/app/5718/ .
2. To configure syslog server and then move logs from CommVault to syslog and create your own dashboards , reports in Splunk .

Does using the app provide something more which we can not get if we configure our monitoring based on the logs of syslog.

Can the app dashboards and reports be customized or create new reports/dashboards as per the requirements ?

**Need Suggestion**

We want to implement Graylog as a syslog solution for commvault but as per commvault document its not tested and verified solution. Can anyone share their experience if they have used it.

Also, This is the first time we are configuring this solution. Can anyone suggest the retention for such logs. And how much space they acquire. 

Thankyou in Advance !!

Tagging in @Scott Moseman and @MFasulo to see if they have input here as well.

We may need to split the questions for @Mohit Chordia and @Garima into new threads, depending on the answers.

I don’t know anyone using Graylog but any syslog server should work.

Thanks,
Scott
 

Thanks @Scott Moseman . Any information on the retention period of the logs and space they need( just a rough estimation to plan the server capacity)?

Are you asking about the retention and space for the syslog data?  I imagine retention is a judgement call based on any SLAs you might have for the business, and I’m not sure about the space.  I assume it can very based on the activity level of the CommServe.

Thanks,
Scott
​