How to get syslog logs into securityonion 2.3?

[lonelyadmin]

I have a single manager with four sensors and two search nodes, after running so-allow, which host am I supposed to send traffic to?
Is there a reverse-proxy or cluster solution for the syslog server?

I ran across this thread, but it doesn't answer my question directly, good start for syslog setup though:
#2136 (comment)

This link suggests they get sent to the individual sensor:
https://docs.securityonion.net/en/2.3/firewall.html?highlight=syslog#allow-hosts-to-send-syslog-to-a-sensor-node

[weslambert]

You can send syslog to any node (since every node type runs Filebeat, which is the syslog receiver). You just need to make sure the firewall allows the connection.

[lonelyadmin]

So there isn't any type of HA builtin? You have to pin certain syslog generators to whatever you deem is the most relevant node to accept it? Would a seperate nginx reverse proxy for syslog that uses all of the nodes as a backend be the way to go?

[djeronimo]

I can't get any logs from my devices to show up in SecurityOnion. I have opened up the firewall, I can see the traffic with tcpdump. But Kibana shows nothing.

[dougburks]

@djeronimo You're replying to an old discussion from 2020. Instead of replying to old discussions, please start a new discussion. Thanks!

[djeronimo]

I Jave @dougburks. No replies yet.