topic Unix App - Report on Differences in Open Ports in All Apps and Add-ons

Unix App - Report on Differences in Open Ports

aferone — Thu, 03 Nov 2011 17:29:07 GMT

We have the *NIX app working, and as an example, we have one system feeding netstat and open port data into it. We are feeding this data every hour. How can I send an alert if the reports each hour don't match? Basically, if a new port is opened, or an existing port is closed, we want to get an alert.

Thanks for the help, as always!

Re: Unix App - Report on Differences in Open Ports

araitz — Thu, 03 Nov 2011 20:41:13 GMT

Try the diff command:

http://docs.splunk.com/Documentation/Splunk/latest/Searchreference/Diff

index=os sourcetype=netstat host=your_host | head 2 | diff

Re: Unix App - Report on Differences in Open Ports

aferone — Fri, 04 Nov 2011 17:36:49 GMT

Thank you for the answer!

Now, I am trying to create a alert for this. Under normal conditions, I get the "** Results are the Same **" message. However, when there is a difference, for example, I get this:

@@ -15,3 +15,4 @@
udp 52480
udp 20031
udp 5353
+udp 1514

I am trying to set up the alert so that obviously it only send us an email when there is a difference. I tried using the custom condition in the alert to exclude the "** Results are the Same **" message, but it is not working.

Any suggestions? Thanks again!

Re: Unix App - Report on Differences in Open Ports

araitz — Tue, 08 Nov 2011 00:19:01 GMT

I think you can filter no-diffs out by adding one of the following to your search:

... | search linecount > 2
... | search NOT "Results are the Same"

Re: Unix App - Report on Differences in Open Ports

aferone — Wed, 09 Nov 2011 16:40:43 GMT

This worked perfectly. Thank you!