topic Re: Can't index data on network drives in (VirtualBox WinXP SP3) in Getting Data In

Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Wed, 17 Aug 2011 16:08:13 GMT

Hello all,

I got the problem, that Splunk is not able to index any data which is on the host system. Splunk itself is running as a guest in VirtualBox on Windows XP. I am able to add a monitoring to the host system by selecting

\\vboxsrv\documents\Logauswertungen\Logs

But Splunk won't index these files. Please see My old Thread for further information. Since the other Thread was concerning another issue, I am opining this one.

Kind regards

EDIT: Here are two screenshots showing the InputData and the Indexes:

I think it's interesting that Splunk finds some files (actually there are only 2 files and 1 folder within this directory) but won't index them.

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

gekoner — Wed, 17 Aug 2011 16:35:16 GMT

If you map the drive using Windows file sharing (i.e. using a network drive letter) and specify that in your data input, does it work? (S:\Logs)

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Wed, 17 Aug 2011 16:55:53 GMT

No it doesn't because the Windows file sharing is done within the local user and the service runs in the system environment. Splunk isn't even able to see the path. (See my old Thread about that).

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

ftk — Wed, 17 Aug 2011 17:31:26 GMT

The user account splunkd runs as needs to have read permissions on your UNC share. What user are you running splunkd as? Is it a domain user, or a local user account?

If you are running splunkd as a domain account, grant the appropriate account read access on your share. If it is running as a local user, either open the share up to the builtin "Everyone" principal or configure identical local accounts (same username and password) on both the log server and the splunk VM, then grant this account read access to the share and run splunkd as this account.

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

MuS — Thu, 18 Aug 2011 08:32:44 GMT

Hi Katsche

again, splunkd.log is your friend - check it for errors/messages.

are the log files to small to be indexed?
are the log files binary?
why don't copy the files locally onto your VM and index them then just to see if this works?
like ftk said, are there any permission issues?
did you fix the 'service accessing UNC windows' stuff?

so many things to check ......... so little time 🙂

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 08:33:27 GMT

Let me explain the circumstances first:

Splunk is running as local user account (admin without any password) within the guest system
The host system is a Managed Windows 7 Enterprise, the user there is within a domain.
-> Sounds if we won't establish anything here, I don't think it will be possible to add the VM to the domain.
Is there a difference between a VirtualBox Shared Folder through the guest additions and a normal UNC share?
I just tried to setup a share for everyone but this share seems to be within the domain and can't be accessed by the guest system at all

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 08:33:33 GMT

I checked the services splunkd and splunkweb in services.msc, they seem to be running in the system account. When I try to change this to the local user the services won't run. I don't get why Splunk can't use the VirtualBox Shared Folder via

\\vboxsrv\...

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 08:39:52 GMT

Then let me take the time to check your points: 🙂

(1) We are talking abount >8MB of data, that isn't too small, is it? (2) The log files are *.log and can be opened with Windows' Notepad or Wordpad. (3) We will be talking about a large amount of data and the size of the VM is limited. That's why i am trying to access data on network drives of the host system. It is wokring with folders within the VM without any problems.

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 08:42:03 GMT

(4) I thought the permissions are granted the second the guest additions in VirtualBox are setup. I can access all of the files in Windows Explorer. No permission issues visible to me. (5) I tried all of the options given here: http://stackoverflow.com/questions/182750/how-to-map-a-network-drive-to-be-used-by-a-service/3821317#3821317

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Mon, 28 Sep 2020 09:48:22 GMT

Except the third one, I don't get it. -> "3.You can also try by making the service as interactive by specifying SERVICE_INTERACTIVE_PROCESS in the servicetype parameter flag of your CreateService() function but this will be limited only till XP as Vista and 7 donot support this feature."

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Ayn — Thu, 18 Aug 2011 08:48:29 GMT

On a related note, this tool could come in handy: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/

It lists the state of each input along with descriptions on why some inputs aren't indexed (if any) etc. Really useful!

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

MuS — Thu, 18 Aug 2011 08:52:03 GMT

Ayn's tool tip is very handy use it.
but I still think your basic problem is that the service account is not able to access the UNC share - follow this http://support.microsoft.com/kb/124184/ to fix it. this has nothing to do with your filesystem permissions or if you are able to click in explorer and open a log file.

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 08:53:28 GMT

@MuS: This is what I found in the splunkd.log: "08-18-2011 09:58:58.894 +0200 WARN TailingProcessor - Insufficient permissions to read file='\VBOXSVR\Documents\Logauswertung\Logs\SystemOut\14.SystemOut.log' (hint: Incorrect function.).
08-18-2011 09:58:58.894 +0200 WARN TailingProcessor - Insufficient permissions to read file='\VBOXSVR\Documents\Logauswertung\Logs\SystemOut\15.SystemOut.log' (hint: Incorrect function.).
"

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 08:54:16 GMT

@Ayn: I will check your link and post the results as soon as possible.

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

MuS — Thu, 18 Aug 2011 09:01:27 GMT

here we go: Insufficient permissions!

fix the UNC windows 'bug' and your set 😉

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 09:10:13 GMT

I started working on your fix MuS. What do I have to enter in this step? "On a new line within the NullSessionShares key, type in the share you want to access with a null session (for example: "PUBLIC")"

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

MuS — Thu, 18 Aug 2011 09:13:51 GMT

🙂

like it says 'type in the share you want to access' so type in the share you want to access.

🙂

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Thu, 18 Aug 2011 09:20:25 GMT

I may sound stupid now, but I am sill not sure what I have to type. I got "\vboxsrv\Documents\Logauswertungen\Logs\" or "E:\Logauswertungen\Logs\" ("Documents on vboxsrv (E:)") pointing on the same folder. What do I have to type? "Documents", "vboxsrv"? I just don't get it. 😛

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

MuS — Thu, 18 Aug 2011 09:34:32 GMT

as the share is the first value after the servername, it should be 'Documents' in your case.

Re: Can't index data on network drives in (VirtualBox WinXP SP3)

Katsche — Mon, 28 Sep 2020 09:48:24 GMT

I edited the Registry Entry (added "Documents") and restarted Windows. I still get the Tailing Processor-Permissions-Error. What do I have to do concerning the "Named Pipes"?

-> If your application uses Named Pipes and requires null session support.

From the HKEY_LOCAL_MACHINE subtree, go to the following key:

     \System
       \CurrentControlSet
         \Services
           \LanmanServer
             \Parameters
               \NullSessionPipes

On a new line within the NullSessionShares key, type in the pipe you want to access with a null session.