topic Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance in Getting Data In

Why is Windows Logs with Event Code 4625 Not appearing in Splunk Instance?

splk_user — Tue, 20 Jun 2023 05:37:14 GMT

Hi,

I'm experiencing an issue where logs with EventCode=4625 from Windows systems (an account failed to log on) are not appearing in my Splunk instance. I have checked the data collection and indexing settings, but still can't find these logs.

Has anyone else encountered a similar problem or have any suggestions on how to troubleshoot this? .

Thank you!

Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance

caiosalonso — Fri, 16 Jun 2023 12:52:44 GMT

Hi,

Are you able to share the stanza for the colletion of Windows Security logs from your inputs.conf file? Just to make sure there is not setting filtering the events.

Also, in the past I had similar issues, but It was due to the Windows Servers, that were configured to not log specific events, so I would recommend to check in the event viewer if the event 4625 is being generated.

Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance

gcusello — Fri, 16 Jun 2023 13:09:12 GMT

Hi @splk_user,

there are two possible answer to this issue:

you have a whitelisting or blacklisting in inputs so you haven't these events;
You have an external Authentication system, so you never have logfailed events in your logs.

you can check the first choice viewing your inputs.conf and the second checking your architecture.

Ciao.

Giuseppe

Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance

VatsalJagani — Fri, 16 Jun 2023 13:42:43 GMT

@splk_user - Also, check on one of the Windows Host, open the EventViewer on the machine and see if you see the event there or not.

Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance

splk_user — Mon, 19 Jun 2023 15:55:24 GMT

Yes, I have checked the Windows Host on the Event Viewer of the machine and I have found event logs with the event ID 4265 but they are not appearing in Splunk Instance

Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance

gcusello — Mon, 19 Jun 2023 16:02:48 GMT

Hi @splk_user,

did you checked my questions?

Ciao.

Giuseppe

Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance

splk_user — Tue, 20 Jun 2023 11:58:37 GMT

Thank you @gcusello ,

But i have checked inputs.conf and the Eventcode=4625 is not blacklisted in the configuration.

and when i checked Event Viewer of the Windows host, i found that logs with event code 4265 are generated

Re: Windows Logs with Event Code 4625 Not appearing in Splunk Instance

splk_user — Tue, 20 Jun 2023 12:00:07 GMT

i have checked in the event viewer and the event 4625 is being generated but i still have the same problem they are not appering in splunk instance

Re: Why is Windows Logs with Event Code 4625 Not appearing in Splunk Instance?

caiosalonso — Tue, 20 Jun 2023 12:07:40 GMT

Could you please share with us the stanza from your inputs.conf file that you are using to monitor Windows Security logs?

Re: Why is Windows Logs with Event Code 4625 Not appearing in Splunk Instance?

splk_user — Tue, 20 Jun 2023 13:51:43 GMT

yes ofcourse here it is

Re: Why is Windows Logs with Event Code 4625 Not appearing in Splunk Instance?

caiosalonso — Tue, 20 Jun 2023 15:22:10 GMT

Is this the only stanza you have for Windows Security? Because this one is disabled.

When you set the parameter disabled = 1 you disable the Windows Security monitor stanza. This parameter should be set as disabled = 0 so you can enable the monitor.