Skip to content

Commit

Permalink
Quickstart_guide.md rendering test (#567)
Browse files Browse the repository at this point in the history
  • Loading branch information
nandinivij authored and GitHub committed Jul 17, 2020
1 parent 8120bdb commit 92f0669
Showing 1 changed file with 40 additions and 14 deletions.
54 changes: 40 additions & 14 deletions docs/gettingstarted/quickstart_guide.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,65 +23,91 @@
### SC4S setup<sub>(using RHEL 7.6)</sub>
* Set the host OS kernel to match the default receive buffer of sc4s which is set to 16MB
* Add following to /etc/sysctl.conf
```
net.core.rmem_default = 1703936
net.core.rmem_max = 1703936
```
* apply to the kernel\
``` sysctl -p```
* Ensure the kernel is not dropping packets\
```netstat -su | grep "receive errors"```

* Install conntrack (RHEL 7/8 with podman only)\
```<dnf or yum> install conntrack```

```
net.core.rmem_default = 1703936
net.core.rmem_max = 1703936
```

* Apply to the kernel

```
sysctl -p
```
* Ensure the kernel is not dropping packets

```
netstat -su | grep "receive errors"
```

* Install conntrack (RHEL 7/8 with podman only)

```
<dnf or yum> install conntrack
```

* Create the systemd unit file `/lib/systemd/system/sc4s.service`. Copy and paste from the
[SC4S sample unit file](https://splunk-connect-for-syslog.readthedocs.io/en/master/gettingstarted/podman-systemd-general/#initial-setup
).

* Install podman or docker

```
sudo yum -y install podman
or
sudo yum install docker-engine -y
```

* Create a local volume that will contain the disk buffer files and other SC4S state files

```
sudo podman volume create splunk-sc4s-var
or
sudo docker volume create splunk-sc4s-var
```

* Create directories used as a mount point for local overrides and configurations

```
mkdir /opt/sc4s/local
mkdir /opt/sc4s/archive
mkdir /opt/sc4s/tls
```

* Create the environment file `/opt/sc4s/env_file` and replace the HEC_URL and HEC_TOKEN as appropriate

```
SPLUNK_HEC_URL=<HEC_URL>
SPLUNK_HEC_TOKEN=<HEC_TOKEN>
#Uncomment the following line if using untrusted SSL certificates
#SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no
```

* Configure SC4S for systemd and start SC4S

```
sudo systemctl daemon-reload
sudo systemctl enable sc4s
sudo systemctl start sc4s
```

* Check podman/docker logs for errors

```
sudo podman logs SC4S
or
sudo docker logs SC4S
```

* Search on Splunk for successful installation of SC4S

```
index=* sourcetype=sc4s:events "starting up"
```

* Send sample data to default udp port 514 of SC4S host
```
echo “Hello SC4S” > /dev/udp/<SC4S_ip>/514
```

```
echo “Hello SC4S” > /dev/udp/<SC4S_ip>/514
```

0 comments on commit 92f0669

Please sign in to comment.