From 92f0669b48319afdf17ea22ae559ad3508e0336b Mon Sep 17 00:00:00 2001 From: nandinivij <61885842+nandinivij@users.noreply.github.com> Date: Fri, 17 Jul 2020 14:49:09 -0700 Subject: [PATCH] Quickstart_guide.md rendering test (#567) --- docs/gettingstarted/quickstart_guide.md | 54 ++++++++++++++++++------- 1 file changed, 40 insertions(+), 14 deletions(-) diff --git a/docs/gettingstarted/quickstart_guide.md b/docs/gettingstarted/quickstart_guide.md index 58ae42d..f787f7e 100644 --- a/docs/gettingstarted/quickstart_guide.md +++ b/docs/gettingstarted/quickstart_guide.md @@ -23,23 +23,36 @@ ### SC4S setup(using RHEL 7.6) * Set the host OS kernel to match the default receive buffer of sc4s which is set to 16MB * Add following to /etc/sysctl.conf - ``` - net.core.rmem_default = 1703936 - net.core.rmem_max = 1703936 - ``` - * apply to the kernel\ - ``` sysctl -p``` -* Ensure the kernel is not dropping packets\ - ```netstat -su | grep "receive errors"``` - - * Install conntrack (RHEL 7/8 with podman only)\ - ``` install conntrack``` + + ``` + net.core.rmem_default = 1703936 + net.core.rmem_max = 1703936 + ``` + + * Apply to the kernel + + ``` + sysctl -p + ``` + +* Ensure the kernel is not dropping packets + + ``` + netstat -su | grep "receive errors" + ``` + + * Install conntrack (RHEL 7/8 with podman only) + + ``` + install conntrack + ``` * Create the systemd unit file `/lib/systemd/system/sc4s.service`. Copy and paste from the [SC4S sample unit file](https://splunk-connect-for-syslog.readthedocs.io/en/master/gettingstarted/podman-systemd-general/#initial-setup ). * Install podman or docker + ``` sudo yum -y install podman or @@ -47,41 +60,54 @@ ``` * Create a local volume that will contain the disk buffer files and other SC4S state files + ``` sudo podman volume create splunk-sc4s-var or sudo docker volume create splunk-sc4s-var ``` + * Create directories used as a mount point for local overrides and configurations + ``` mkdir /opt/sc4s/local mkdir /opt/sc4s/archive mkdir /opt/sc4s/tls ``` + * Create the environment file `/opt/sc4s/env_file` and replace the HEC_URL and HEC_TOKEN as appropriate + ``` SPLUNK_HEC_URL= SPLUNK_HEC_TOKEN= #Uncomment the following line if using untrusted SSL certificates #SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no ``` + * Configure SC4S for systemd and start SC4S + ``` sudo systemctl daemon-reload sudo systemctl enable sc4s sudo systemctl start sc4s ``` + * Check podman/docker logs for errors + ``` sudo podman logs SC4S or sudo docker logs SC4S ``` + * Search on Splunk for successful installation of SC4S + ``` index=* sourcetype=sc4s:events "starting up" ``` + * Send sample data to default udp port 514 of SC4S host - ``` - echo “Hello SC4S” > /dev/udp//514 - ``` + + ``` + echo “Hello SC4S” > /dev/udp//514 + ```