From c964c07f97ab209e3500067a6093105c34a5a580 Mon Sep 17 00:00:00 2001 From: mbonsack Date: Wed, 11 Sep 2019 11:26:54 -0700 Subject: [PATCH] Docs Cleanup (#81) Fixed filter references in Juniper; cleaned up main gettingstarted page --- docs/gettingstarted.md | 55 ++---------------------------------------- docs/sources.md | 4 +-- 2 files changed, 4 insertions(+), 55 deletions(-) diff --git a/docs/gettingstarted.md b/docs/gettingstarted.md index 0172e22..90917fe 100644 --- a/docs/gettingstarted.md +++ b/docs/gettingstarted.md @@ -67,7 +67,7 @@ Refer to [Splunk Enterprise](http://dev.splunk.com/view/event-collector/SP-CAAAE | [Docker CE + systemd single node](gettingstarted/docker-systemd-general.md) | First choice for Debian, Ubuntu, and CentOS distributions with limited existing docker experience | | [Docker CE + Swarm single node](gettingstarted/docker-swarm-general.md) | Option for Debian, Ubuntu, and CentOS desiring swarm orchestration | | [Docker CE + Swarm single node RHEL 7.7](gettingstarted/docker-swarm-rhel7.md) | Option for RedHat 7.7 desiring swarm orchestration | -======= + # Pre-req * Linux host with Docker 19.x or newer with Docker Swarm enabled @@ -76,60 +76,9 @@ Refer to [Splunk Enterprise](http://dev.splunk.com/view/event-collector/SP-CAAAE * One or more Splunk indexes for events collected by SC4S * Splunk HTTP event collector enabled with a token dedicated for SC4S * [Splunk Enterprise](http://dev.splunk.com/view/event-collector/SP-CAAAE6Q) - * [Splunk Enterprise Cloud](http://docs.splunk.com/Documentation/Splunk/7.3.1/Data/UsetheHTTPEventCollector#Configure_HTTP_Event_Collector_on_managed_Splunk_Cloud) + * [Splunk Cloud](http://docs.splunk.com/Documentation/Splunk/7.3.1/Data/UsetheHTTPEventCollector#Configure_HTTP_Event_Collector_on_managed_Splunk_Cloud) * A network load balancer (NLB) configured for round robin. Note: Special consideration may be required when more advanced products are used. The optimal configuration of the load balancer will round robin each http POST request (not each connection) -# Setup - -* Create a directory on the server for configuration -* Create a docker-compose.yml file based on the following template - -```yaml -version: "3" -services: - sc4s: - image: splunk/scs:latest - hostname: sc4s - ports: - - "514:514" - - "601:601" - - "514:514/udp" - - "5514:5514" - - "5514:5514/udp" - stdin_open: true - tty: true - environment: - - SPLUNK_HEC_URL=https://foo:8088/services/collector/event - - SPLUNK_HEC_TOKEN= - - SPLUNK_CONNECT_METHOD=hec - - SPLUNK_DEFAULT_INDEX= - - SPLUNK_METRICS_INDEX=em_metrics - volumes: - - ./sc4s/splunk_index.csv:/opt/syslog-ng/etc/context-local/splunk_index.csv - - ./sc4s/splunk_index.csv:/opt/syslog-ng/etc/context-local/splunk_index.csv -``` - -## Configure index destinations for Splunk -* Download the latest context.csv file to a subdirectory sc4s below the docker-compose.yml file created above -```bash -wget https://raw.githubusercontent.com/splunk/splunk-connect-for-syslog/master/package/etc/context-local/splunk_index.csv -``` -* Edit splunk_index.csv review the index configuration and revise as required for sourcertypes utilized in your environment. For instance, add *cisco:asa,index,netfw* to splunk_index.csv for Cisco-ASA data source. - -## Configure sources by source IP or host name -* This step is required even if not used -* Download the latest vendor_product_by_source.conf file to a subdirectory sc4s below the docker-compose.yml file created above -```bash -wget https://raw.githubusercontent.com/splunk/splunk-connect-for-syslog/master/package/etc/context-local/vendor_product_by_source.conf -``` -* Edit the file to identify appropriate vendor products by host glob or network mask using syslog-ng filter syntax. - -* Start SC4S - -```bash -docker stack deploy --compose-file docker-compose.yml sc4s -``` - ## Scale out diff --git a/docs/sources.md b/docs/sources.md index dff4b07..0ff737a 100644 --- a/docs/sources.md +++ b/docs/sources.md @@ -284,7 +284,7 @@ Verify timestamp, and host values match as expected ### Filter type -* Juniper NSM products must be identified by host or ip assignment. Update the filter `f_juniper_nsm` or `f_uniper_idp` as required +* Juniper NSM products must be identified by host or ip assignment. Update the filter `f_juniper_nsm` or `f_juniper_nsm_idp` as required ### Setup and Configuration @@ -328,7 +328,7 @@ Verify timestamp, and host values match as expected ### Filter type -* Juniper Netscreen products must be identified by host or ip assignment. Update the filter `f_juniper_netscreen` or `juniper_idp` as required +* Juniper Netscreen products must be identified by host or ip assignment. Update the filter `f_juniper_netscreen` or `f_juniper_idp` as required ### Setup and Configuration