From 92f0669b48319afdf17ea22ae559ad3508e0336b Mon Sep 17 00:00:00 2001
From: nandinivij <61885842+nandinivij@users.noreply.github.com>
Date: Fri, 17 Jul 2020 14:49:09 -0700
Subject: [PATCH] Quickstart_guide.md rendering test (#567)
---
docs/gettingstarted/quickstart_guide.md | 54 ++++++++++++++++++-------
1 file changed, 40 insertions(+), 14 deletions(-)
diff --git a/docs/gettingstarted/quickstart_guide.md b/docs/gettingstarted/quickstart_guide.md
index 58ae42d..f787f7e 100644
--- a/docs/gettingstarted/quickstart_guide.md
+++ b/docs/gettingstarted/quickstart_guide.md
@@ -23,23 +23,36 @@
### SC4S setup(using RHEL 7.6)
* Set the host OS kernel to match the default receive buffer of sc4s which is set to 16MB
* Add following to /etc/sysctl.conf
- ```
- net.core.rmem_default = 1703936
- net.core.rmem_max = 1703936
- ```
- * apply to the kernel\
- ``` sysctl -p```
-* Ensure the kernel is not dropping packets\
- ```netstat -su | grep "receive errors"```
-
- * Install conntrack (RHEL 7/8 with podman only)\
- ``` install conntrack```
+
+ ```
+ net.core.rmem_default = 1703936
+ net.core.rmem_max = 1703936
+ ```
+
+ * Apply to the kernel
+
+ ```
+ sysctl -p
+ ```
+
+* Ensure the kernel is not dropping packets
+
+ ```
+ netstat -su | grep "receive errors"
+ ```
+
+ * Install conntrack (RHEL 7/8 with podman only)
+
+ ```
+ install conntrack
+ ```
* Create the systemd unit file `/lib/systemd/system/sc4s.service`. Copy and paste from the
[SC4S sample unit file](https://splunk-connect-for-syslog.readthedocs.io/en/master/gettingstarted/podman-systemd-general/#initial-setup
).
* Install podman or docker
+
```
sudo yum -y install podman
or
@@ -47,41 +60,54 @@
```
* Create a local volume that will contain the disk buffer files and other SC4S state files
+
```
sudo podman volume create splunk-sc4s-var
or
sudo docker volume create splunk-sc4s-var
```
+
* Create directories used as a mount point for local overrides and configurations
+
```
mkdir /opt/sc4s/local
mkdir /opt/sc4s/archive
mkdir /opt/sc4s/tls
```
+
* Create the environment file `/opt/sc4s/env_file` and replace the HEC_URL and HEC_TOKEN as appropriate
+
```
SPLUNK_HEC_URL=
SPLUNK_HEC_TOKEN=
#Uncomment the following line if using untrusted SSL certificates
#SC4S_DEST_SPLUNK_HEC_TLS_VERIFY=no
```
+
* Configure SC4S for systemd and start SC4S
+
```
sudo systemctl daemon-reload
sudo systemctl enable sc4s
sudo systemctl start sc4s
```
+
* Check podman/docker logs for errors
+
```
sudo podman logs SC4S
or
sudo docker logs SC4S
```
+
* Search on Splunk for successful installation of SC4S
+
```
index=* sourcetype=sc4s:events "starting up"
```
+
* Send sample data to default udp port 514 of SC4S host
- ```
- echo “Hello SC4S” > /dev/udp//514
- ```
+
+ ```
+ echo “Hello SC4S” > /dev/udp//514
+ ```