Search code examples
githubsplunksplunk-query

how to monitor the GitHub Appliance instance using splunk

We have GitHub Enterprise appliance and we need to forward the GitHub logs to independent store where splunk can monitor.. How can we achieve this

Solution

  • You will need to enable Log Forwarding, which exports the audit log from the GitHub appliance via syslog

    https://help.github.com/en/enterprise/2.16/admin/installation/log-forwarding

    On the Management Console settings page, in the left sidebar, click Monitoring.
Select Enable log forwarding.
In the Server address field, type the address of the server to which you want to forward logs. You can specify multiple addresses in a comma-separated list.
In the Protocol drop-down menu, select the protocol to use to communicate with the log server. The protocol will apply to all specified log destinations.

    You will need to enable a receiver on the Splunk side to receive the syslog, or have it read from a file written by a syslog listener