# Splunk Connect for Syslog (SC4S)

Onboarding allows you to collect metrics about the host, display the host on the **Topology** page, and to tap into the log flow.

Onboarding requires you to modify the host and the configuration of the logging agent (SC4S) running on the host.

  * Level 1: Install Axolet on the host where SC4S is running. Axolet collects metrics from the host and sends them to the AxoConsole, so you can check host-level metrics on the **Metrics & Health** page of the host, and displays the host on the **Topology** page.
  * Level 2: Instrument the configuration of the logging agent to provide detailed metrics about the traffic flow. This allows you to display data about the host on the **Analytics** page.
  * Level 3: Instrument the configuration of the logging agent to allow you to access the logs of the logging agent and to [tap into the log flow from the AxoConsole](../../docs/axoflow/onboard-hosts/log-tapping/index.md). The exact steps for this integration depend on the configuration of your logging agent. We provide basic instrumentation instructions for getting started in this guide, but we strongly recommend to [contact us so our professional services can help you with a production integration](<https://axoflow.com/contact>).



To generate metrics for the Axoflow platform from an existing [Splunk Connect for Syslog (SC4S)](<https://splunk.github.io/splunk-connect-for-syslog/main/>) instance, you need to configure SC4S to generate these metrics. Complete the following steps.

  1. If you haven’t already done so, [install Axolet on the host](../../docs/axoflow/provisioning/axorouter/linux/index.md), then approve its registration on the **Provisioning** page of the AxoConsole.

  2. Download the following code snippet as `axoflow-instrumentation.conf`.
```
 @define allow-config-dups 1
             
             block parser classifier-parser() {
                 metrics-probe(
                         key("classified_events_total")
                                 labels(
                                     "app" => "${.splunk.sourcetype}"
                                     "host" => "${HOST}"
                                     "program" => "${.splunk.source}"
                                     "source" => "${SOURCE}"
                                 )
                 );
             };
             
             @module confgen context(root) name(dest_hec) exec("`SC4S_ETC`/conf.d/destinations/dest_hec/plugin.py | sed -e '/^destination d_hec/a\    channel { parser { classifier-parser(); }; destination {' -e '/^};/i\ };};'  ")
             dest_hec()
             
             @define allow-config-dups 0
             
```

  3. If you are running SC4S under podman or docker, copy the file into the `/opt/sc4s/local/config/destinations` directory. In other deployment methods this might be different, check the SC4S documentation for details.

  4. Check if the metrics are appearing, for example, run the following command on the SC4S host:
```
 syslog-ng-ctl stats prometheus | grep classified
         
```