# Splunk Connect for Syslog (SC4S)

Onboarding allows you to collect metrics about the host, display the host on the **Topology** page, and to tap into the log flow.

Onboarding requires you to modify the host and the configuration of the logging agent (SC4S) running on the host.

  * Level 1: Install Axolet on the host where SC4S is running. Axolet collects metrics from the host and sends them to the AxoConsole, so you can check host-level metrics on the **Metrics & Health** page of the host, and displays the host on the **Topology** page.
  * Level 2: Instrument the configuration of the logging agent to provide detailed metrics about the traffic flow. This allows you to display data about the host on the **Analytics** page.
  * Level 3: Instrument the configuration of the logging agent to allow you to access the logs of the logging agent and to [tap into the log flow from the AxoConsole](../../docs/axoflow/0.81/onboard-hosts/log-tapping/index.md). The exact steps for this integration depend on the configuration of your logging agent. We provide basic instrumentation instructions for getting started in this guide, but we strongly recommend to [contact us so our professional services can help you with a production integration](<https://axoflow.com/contact>).



To generate metrics for the Axoflow platform from an existing [Splunk Connect for Syslog (SC4S)](<https://splunk.github.io/splunk-connect-for-syslog/main/>) instance, you need to configure SC4S to generate these metrics. Complete the following steps.

  1. If you haven’t already done so, [install Axolet on the host](../../docs/axoflow/0.81/provisioning/axorouter/linux/index.md), then approve its registration on the **Provisioning** page of the AxoConsole.

  2. Download the following code snippet as `axoflow-instrumentation.conf`.
```
 @define allow-config-dups 1
         
         block parser classifier-parser() {
           metrics-probe(
             key("classified_events_total")
             labels(
               "app" => "${.splunk.sourcetype}"
               "host" => "${HOST}"
               "program" => "${.splunk.source}"
               "source" => "${SOURCE}"
             )
           );
         };
         
         @module confgen context(root) name(dest_hec) exec("`SC4S_ETC`/conf.d/destinations/dest_hec/plugin.py | sed -e '/^destination d_hec/a\    channel { parser { classifier-parser(); }; destination {' -e '/^};/i\ };};'  ")
         dest_hec()
         
         @define allow-config-dups 0
         
```

  3. If you are running SC4S under podman or docker, copy the file into the `/opt/sc4s/local/config/destinations` directory. In other deployment methods this might be different, check the SC4S documentation for details.

  4. Check if the metrics are appearing, for example, run the following command on the SC4S host:
```
 syslog-ng-ctl stats prometheus | grep classified
         
```

  5. If SC4S is sending data to an AxoRouter, create a placeholder [data forwarding rule](../../docs/axoflow/0.81/data-sources/data-forwarding/index.md) where the **Edge Selector** matches SC4S and the **Router connector** is the connector of the AxoRouter instance where SC4S is sending the data. This is needed to display SC4S and its data metrics on the **Topology** page, AxoConsole won’t manage SC4S.