topic linux_audit logs in Security

linux_audit logs

dude49 — Fri, 27 Sep 2024 19:22:08 GMT

My linux_audit logs increased after updating apps and causing license manager to go over limit. Anyone know a fix for this, I have looked for the stanzas on the backend but not able to find out where these logs are coming from.

Re: linux_audit logs

richgalloway — Fri, 27 Sep 2024 19:36:29 GMT

Go to one of the Linux servers that is reporting audit logs and run btool on the CLI.

splunk btool --debug inputs list | grep audit

The output will include the name of the inputs.conf file where the input is defined. Edit that file (or its peer in /local) to disable the input.

Re: linux_audit logs

PickleRick — Fri, 27 Sep 2024 20:02:33 GMT

This is not strictly Splunk question.

If your systems started producing more audit events something must have changed. Probably either audit rules defined in your systems changed or the systems' behaviour changed so they report more events. It's something you need to resolve with your Linux admins. You could compare old data with new data to see what changed - whether there are more messages of some particular types or maybe new processes started geting "caught" by audit.

Re: linux_audit logs

isoutamo — Sat, 28 Sep 2024 10:53:52 GMT

Or someone has added more servers under linux audit log collections.
Then best options is look when amount has increased and is node amount also increased on splunk side. If not then just look if then content on any individual nodes has increased and changed. Based on that you have more to discuss with you linux and/or splunk DS admins.

Re: linux_audit logs

dude49 — Mon, 30 Sep 2024 14:30:02 GMT

So I did some research of when the uptick happened. It started last Monday before I starting upgrading Splunk. I blacklisted the host that were having the large amount of audit logs and reached out to the department for those host. Looks like it wasnt an app but servers possibly added or ingesting more due to a change. Will find out more once the department responds. Until then, will keep them blacklisted so that we stay under our license amount