topic Re: How to get linux logs to blacklist in input.conf? in Getting Data In

How to get linux logs to blacklist in input.conf?

shashilendra — Wed, 07 Dec 2022 16:13:45 GMT

Hi Team,

getting huges audit logs and wanted to blacklist in input.conf .

index=*linux* source="/var/log/audit/audit.log" type=proctitle

Re: How to get linux logs to blacklist in input.conf?

VatsalJagani — Wed, 07 Dec 2022 17:47:16 GMT

@shashilendra - I don't think what you are trying to do is possible at the input level with any built-in Splunk configuration.

You can do it by Null Queue (with props/transforms configuration) at the parsing stage.

props.conf

[source::/var/log/audit/audit.log] TRANSFORMS-filter_some_logs

transforms.conf

[filter_some_logs] REGEX = type=proctitle DEST_KEY = queue FORMAT = nullQueue # NOTE - make sure your _raw event has "type=proctitle" in it, change it if the format is different.

Hope this helps. Kindly accept the answer and upvote the answer if this helps!!!

Re: How to get linux logs to blacklist in input.conf?

richgalloway — Wed, 07 Dec 2022 18:15:25 GMT

Deny ("black") lists apply only to files. To filter individual events, use transforms as suggested by @VatsalJagani or try the new Ingest Action feature, which is similar but a little easier to use. See https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/DataIngest

Re: How to get linux logs to blacklist in input.conf?

shashilendra — Tue, 27 Dec 2022 09:13:30 GMT

Hi , Can i push prop.conf and transfrom.conf via deployment server to Universal Forwarder (installed on 600 Linux server)

i am thinking to create these prop and transfroms file on deployment server under /opt/splunk/etc/deployment-apps/<App Name>/local.

will it work

thanks

shashi

Re: How to get linux logs to blacklist in input.conf?

VatsalJagani — Tue, 27 Dec 2022 12:48:13 GMT

@shashilendra - Yes you can push the configuration from the deployment server to UF.

But, nullQueue configuration to the machine which parses the logs. Usually, that's Indexer (considering the UF is sending logs to Indexers directly.)

* UF does not have the capability to run TRANSFORM.

Re: How to get linux logs to blacklist in input.conf?

PickleRick — Tue, 27 Dec 2022 14:51:45 GMT

I'd start at the beginning of your process, not at its end.

Make sure you're logging (only) what you need with auditd and understand what you're logging and ingesting.

Cutting some parts of the logs blindly can result in missing information.

See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files