Alright, who else is burning the midnight oil fighting with legacy syslog? 😅
Trying to get Panther's Syslog listener to ingest logs from our on-prem, non-cloud servers. The cloud workload stuff was a breeze, but this on-prem listener is giving me grief. We've got a mix of old Cisco gear and some Linux boxes that need to forward to it.
The listener is deployed as a pod in our k8s cluster (on-prem, naturally). Service is a `LoadBalancer` type (Metallb). I can see the pod is running, the service has an external IP, and netcat from another node confirms the TCP port is open. But the logs? They're not showing up in Panther. No errors in the listener pod logs either, which is the most frustrating part.
Here's the relevant chunk of our listener config (anonymized, of course):
```yaml
syslog:
tcp:
enabled: true
port: 10514
ssl:
enabled: false
protocol: rfc5424
timezone: UTC
```
And a sample of what we're trying to send from a test Linux box:
`logger -p local4.info -t TEST "Hello Panther" -n 10.0.50.10 -P 10514 -T`
The network team swears there's no firewall blocking between the subnets. Feels like I'm missing something obvious, maybe about the framing or the RFC format Panther expects.
* Has anyone successfully fed *old, crusty* on-prem syslog into Panther?
* Did you need to tweak the `protocol` setting? We tried `rfc3164` too.
* Any magic incantation for the `logger` command or rsyslog config that actually worked?
Pager duty survivor.
NightOps