Hi everyone,
currently i'm investigating what the best practice is to send logging from mobile devices (Android) to Splunk.
The android devices are logging in the syslog RFC5425 format and are using mutual TLS to send log data. This is because the devices are used in untrusted networks.
I know that the best practice for syslog was to use a dedicated syslog server so receive syslog data. but, as far as i know, the reason for this was that syslog was sending his data over UDP, that is not the case here.
The situation that i am using right now is: android device > syslog-ng > UF > Indexer.
syslog-ng is the log collector that is open to the internet to receive log data.
UF is listening to the saved files and sends it to the indexer.
The question is, am i doing it right? Is there maybe a better way to handle log data from multiple android devices?
Thanks!
↧