topic Re: Forward additional Windows logs in Deployment Architecture

Forward additional Windows logs

bbazian — Sun, 29 Jan 2017 12:14:04 GMT

I am trying to get additional logs sent to Splunk Cloud from a Windows domain controller. I modified my inputs.conf file to add the additional logs but do not see them in the wineventlog index. Am I missing something. Here is the inputs.conf contents.

[default]
host = DC1

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

[WinEventLog://Application]
disabled = 0
[WinEventLog://Security]
disabled = 0
[WinEventLog://System]
disabled = 0
[WinEventLog://DNS Server]
disabled = 0
[WinEventLog://Directory Service]
disabled = 0
[WinEventLog://File Replication Service]
disabled = 0

Re: Forward additional Windows logs

Richfez — Sun, 29 Jan 2017 13:22:19 GMT

Do you see any logs from this host? If you search index=* host=XYZ over the past 24 hours (or some other reasonable time frame) what do you get?

Also, try adding index = wineventlog into each of those stanzas to force them (hopefully) to the right index.

Re: Forward additional Windows logs

bbazian — Sun, 29 Jan 2017 13:42:51 GMT

I do see the security, system and application logs. Not the others that I have in the inputs.conf file. Prior to the addition to the input.conf I saw those logs with the following config.

[default]
host = DC1

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
disabled = 0

I just added the individual log entries.

Re: Forward additional Windows logs

skoelpin — Sun, 29 Jan 2017 14:49:27 GMT

Did you bump the service after modifying inputs.conf?

Re: Forward additional Windows logs

bbazian — Sun, 29 Jan 2017 16:47:25 GMT

Yes. I restarted the Splunk service.

Re: Forward additional Windows logs

bbazian — Mon, 30 Jan 2017 13:18:48 GMT

Anyone have any other ideas?

Re: Forward additional Windows logs

bbazian — Mon, 30 Jan 2017 13:28:44 GMT

I do see the the Directory Service log in the default index. I changed the inputs.conf file to read as below. We will see what that does.

[default]
host = OKDC1

[script://$SPLUNK_HOME\bin\scripts\splunk-wmi.path]
index = wineventlog
disabled = 0

[WinEventLog://Application]
index = wineventlog
disabled = 0

[WinEventLog://Security]
index = wineventlog
disabled = 0

[WinEventLog://System]
index = wineventlog
disabled = 0

[WinEventLog://DNS Server]
index = wineventlog
disabled = 0
index = wineventlog

[WinEventLog://Directory Service]
index = wineventlog
disabled = 0

[WinEventLog://File Replication Service]
index = wineventlog
disabled = 0

Re: Forward additional Windows logs

bbazian — Mon, 30 Jan 2017 13:49:14 GMT

I am now seeing the info for the Directory Service in the wineventlog.

Re: Forward additional Windows logs

jkat54 — Mon, 30 Jan 2017 13:53:22 GMT

Please check the permissions on the event logs.

https://blogs.technet.microsoft.com/janelewis/2010/04/30/giving-non-administrators-permission-to-read-event-logs-windows-2003-and-windows-2008/