Update to include HEC Ack warning in runtime docs

* Update runtime docs to warn against setting HEC Ack
CSVD · Feb 12, 2020 · 121de7b · 121de7b
1 parent e53ed1a
commit 121de7b
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 5 deletions.
diff --git a/docs/configuration.md b/docs/configuration.md
@@ -11,7 +11,8 @@ and variables needed to properly configure SC4S for your environment.
 | SPLUNK_HEC_TOKEN | string | Splunk HTTP Event Collector Token |
 
 * NOTE:  Do _not_ configure HEC Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http
-destination does not support this feature.  Moreover, HEC would significantly degrade performance for streaming data such as syslog.
+destination does not support this feature.  Moreover, HEC Ack would significantly degrade performance for streaming data such as
+syslog.
 
 
 ## Splunk HEC Destination Configuration

diff --git a/docs/gettingstarted/docker-swarm-general.md b/docs/gettingstarted/docker-swarm-general.md
@@ -111,7 +111,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6
 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no
 ```
 
-* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment.
+* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment.  Do _not_ configure HEC
+Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this
+feature.  Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog.
 
 * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32.
 If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer.

diff --git a/docs/gettingstarted/docker-swarm-rhel7.md b/docs/gettingstarted/docker-swarm-rhel7.md
@@ -119,7 +119,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6
 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no
 ```
 
-* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment.
+* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment.  Do _not_ configure HEC
+Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this
+feature.  Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog.
 
 * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32.
 If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer.

diff --git a/docs/gettingstarted/docker-systemd-general.md b/docs/gettingstarted/docker-systemd-general.md
@@ -117,7 +117,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6
 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no
 ```
 
-* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment
+* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment.  Do _not_ configure HEC
+Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this
+feature.  Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog.
 
 * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32.
 If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer.

diff --git a/docs/gettingstarted/podman-systemd-general.md b/docs/gettingstarted/podman-systemd-general.md
@@ -99,7 +99,9 @@ SC4S_DEST_SPLUNK_HEC_WORKERS=6
 #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no
 ```
 
-* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment
+* Update ``SPLUNK_HEC_URL`` and ``SPLUNK_HEC_TOKEN`` to reflect the correct values for your environment.  Do _not_ configure HEC
+Acknowledgement when deploying the HEC token on the Splunk side; the underlying syslog-ng http destination does not support this
+feature.  Moreover, HEC Ack would significantly degrade performance for streaming data such as syslog.
 
 * Set `SC4S_DEST_SPLUNK_HEC_WORKERS` to match the number of indexers and/or HWFs with HEC endpoints, up to a maxiumum of 32.
 If the endpoint is a VIP, match this value to the total number of indexers behind the load balancer.