topic Re: Security Audit issue in Splunk App for Active Directory in All Apps and Add-ons

Security Audit issue in Splunk App for Active Directory

Nguyen_Ma — Wed, 11 Jul 2012 07:46:55 GMT

Hi all,

When I access to any field of Security -> Audit in Splunk app for Active Directory. I received an error message [command="ldapsearch", IO::Socket::INET: connect: Connection refused]. I don't have much experience with Perl. Anyone help me by any advise?

Thank you so much

Re: Security Audit issue in Splunk App for Active Directory

Drainy — Wed, 11 Jul 2012 07:49:44 GMT

Have you verified the ldap server details in the config file? If you entered the wrong details then its quite likely you would receive a connection refused. Also if a local firewall is restricting access out of the local machine to the remote ldap server.

Re: Security Audit issue in Splunk App for Active Directory

Nguyen_Ma — Wed, 11 Jul 2012 09:08:19 GMT

Thank for your answer, I've just configured activedirectory.conf file and got new issue. I access to Security -> Audit -> Administrator Audit and got a message "No matching fields exist". Then I go to User Audit, I got an error message [command="ldapsearch", No such object]. My config file as below:

[server]
ldapurl=ldap://192.168.81.230
basedn=dc=vsslab,dc=com
bindas=cn=Administrator,cn=Users,dc=vsslab,dc=com
password=*******

My domain is vsslab.com

Re: Security Audit issue in Splunk App for Active Directory

Drainy — Wed, 11 Jul 2012 09:21:53 GMT

You need to verify your object definitions. It sounds like it cannot find them on the remote LDAP server

Re: Security Audit issue in Splunk App for Active Directory

ahall_splunk — Wed, 11 Jul 2012 13:57:20 GMT

Following on from the excellent answer from Drainy, it's common to get a message "No matching fields exist" in the Administrator Audit - the page does six searches - if one of the searches has no results, then you get the error.

On your user audit page, it means that it could not find the username that you typed in. Make sure you are typing in the sAMAccountName of the account you want to view.