commvault.com commvault.com
Solved

Syslog format

A
Rank
Badge +6

Hi There.

I have a request from a customer to provide the format of the syslog event that are sent by CommServe to their Syslog Server (ArcSight Syslog Server)

Does anyone know what the format looks like and if possible provide a sample.

 

Thanks

Abdellatif

icon

Best answer by MFasulo 26 April 2021, 16:23

View original

14 replies

MFasulo
Rank
Userlevel 6
Badge +12

Abdellatif please search on connect for the internal resources available for syslog. 

 

Archsight syslog server and various other syslog servers are supported

 

For the rest of the community, we introduced syslog via UDP in 11.20.  Events, alerts, and audit can be forwarded to a syslog server

In 11.23 we introduced syslog over TLS, so you can securely forward events, alerts, and audit.  

Cunningham and I have configured this to FWD to Splunk using both methods.  You can see the results below (might need to click the image to read it)

 

A
Rank
Badge +6

Thanks MFasulo for the info.

At least I have an idea on how the syslog format is.

I also noticed that this is configurable only from the Command Center. Couldn’t find it on CommCell Java GUI.

I am not very familiar with Connect to find the internal resources but will try to.

 

Thanks and regards

Abdellatif

MFasulo
Rank
Userlevel 6
Badge +12

Thanks MFasulo for the info.

At least I have an idea on how the syslog format is.

I also noticed that this is configurable only from the Command Center. Couldn’t find it on CommCell Java GUI.

I am not very familiar with Connect to find the internal resources but will try to.

 

Thanks and regards

Abdellatif

 

No problem, ill send you a message and help you out.

I’m not sure if this made it into Java UI, my primary focus is Command Center  :wink:

0
Rank
Userlevel 2
Badge +9

Guys, I have a question here, does Commvault send logs to syslog(splunk) immediately or are they sent in bulk at certain frequencies?

Scott Moseman
Rank
Userlevel 6
Badge +18

Guys, I have a question here, does Commvault send logs to syslog(splunk) immediately or are they sent in bulk at certain frequencies?


In my lab, I’m seeing syslog messages arriving every 8 minutes.

Thanks,
Scott
 

Commvault Enterprise Success
0
Rank
Userlevel 2
Badge +9

 

Guys, I have a question here, does Commvault send logs to syslog(splunk) immediately or are they sent in bulk at certain frequencies?


In my lab, I’m seeing syslog messages arriving every 8 minutes.

Thanks,
Scott
 

@Scott Moseman Isn't there a way to send this continuously, like Commvault Event Viewer.. ? In our environment, this sometimes takes 15-20 minutes.

 

Scott Moseman
Rank
Userlevel 6
Badge +18

@Scott Moseman Isn't there a way to send this continuously, like Commvault Event Viewer.. ? In our environment, this sometimes takes 15-20 minutes.


I confirmed the product is configured for 8 minute intervals.
At this time, to change it, you can open up a Support case.

Thanks,
Scott
 

Commvault Enterprise Success
0
Rank
Userlevel 2
Badge +9

Thanks @Scott Moseman for the confirmation.

Mohit Chordia
Rank
Userlevel 3
Badge +11

Need some suggestion :

What is the recommended way to configure Commvault logs in Splunk . Which will provide you more control over the logs .

  1. To use Commvault Splunk app https://splunkbase.splunk.com/app/5718/ .
  2. To configure syslog server and then move logs from CommVault to syslog and create your own dashboards , reports in Splunk .

Does using the app provide something more which we can not get if we configure our monitoring based on the logs of syslog.

Can the app dashboards and reports be customized or create new reports/dashboards as per the requirements ?

G
Rank
Badge +1

**Need Suggestion**

We want to implement Graylog as a syslog solution for commvault but as per commvault document its not tested and verified solution. Can anyone share their experience if they have used it.

Also, This is the first time we are configuring this solution. Can anyone suggest the retention for such logs. And how much space they acquire. 

 

Thankyou in Advance !!

Mike Struening RETIRED
Rank
Userlevel 7
Badge +23

Tagging in @Scott Moseman and @MFasulo to see if they have input here as well.

We may need to split the questions for @Mohit Chordia and @Garima into new threads, depending on the answers.

https://www.linkedin.com/in/michael-struening
Scott Moseman
Rank
Userlevel 6
Badge +18

We want to implement Graylog as a syslog solution for commvault but as per commvault document its not tested and verified solution. Can anyone share their experience if they have used it.


I don’t know anyone using Graylog but any syslog server should work.

Thanks,
Scott
 

Commvault Enterprise Success
G
Rank
Badge +1

Thanks @Scott Moseman . Any information on the retention period of the logs and space they need( just a rough estimation to plan the server capacity)?

Scott Moseman
Rank
Userlevel 6
Badge +18

Thanks @Scott Moseman . Any information on the retention period of the logs and space they need( just a rough estimation to plan the server capacity)?


Are you asking about the retention and space for the syslog data?  I imagine retention is a judgement call based on any SLAs you might have for the business, and I’m not sure about the space.  I assume it can very based on the activity level of the CommServe.

Thanks,
Scott
​

Commvault Enterprise Success

Reply


Terms & ConditionsCookie settings