Configuring Splunk Universal Forwarder on Forefront TMG 2010

“…Splunk is one of the more popular log management systems in use today, and to make it easier to get Forefront TMG log data in to Splunk we can use the Splunk Universal Forwarder. The Universal Forwarder is a utility that installs on the Forefront TMG firewall and monitors the folder containing W3C formatted text log files. The Universal Forwarder has a small footprint and consumes few resources, making it the ideal method to collect Forefront TMG log data and deliver it to the Splunk indexing server for analysis and archiving. The Splunk Universal Forwarder can be downloaded here…

For the rest of the story, check out Richard Hick’s blog over at:

http://tmgblog.richardhicks.com/2011/07/26/configuring-splunk-universal-forwarder-on-forefront-tmg-2010/

HTH,

Deb

DEBRA LITTLEJOHN SHINDER
MVP (Enterprise Security)
“MS SECURITY”
[email protected]