Hello,
I think the subject summarizes. I searched for *answers*, but could not find a clear one.
I have my only indexer already configured to listen to UDP 514.
Unfortunately, now I have a second class of devices for which I cannot change the syslog port. I installed a Universal forwarder on a remote server, to collect the logs from these devices and forward them to the indexer.
I'm probably missing something really trivial, but when I go to add the new server class as a forwarded data input, at the very end port UDP 514 is not accepted with error :
> Parameter name: UDP port 514 is not available.
But, I'm not trying to collect data on UDP 514 directly from the indexer, in which case that error would make sense... I'm forwarding data from a different machine, which I understand communicate with the indexer on an entirely different port (8089 if I'm not mistaken.
Isn't one of the major point of having forwarders the ability to *re-use* the same port? Like I said, I must be missing something. :-)
Thanks,
Luca
↧