topic Excluding a process from regmon on Windows in Getting Data In

Excluding a process from regmon on Windows

kogane — Thu, 10 Oct 2013 17:14:38 GMT

Is there a way to configure regmon-filters.conf such that it captures all Windows registry changes, EXCEPT for one or more processes? For example, capture everything except changes by splunkd.exe.

Re: Excluding a process from regmon on Windows

lukejadamec — Thu, 10 Oct 2013 18:59:17 GMT

Yes. See this document, and be sure to select the your Splunk version in the upper right.
http://docs.splunk.com/Documentation/Splunk/5.0.5/admin/Regmon-filtersconf

Generally speaking, to exclude splunkd.exe you add a custom stanza at the global level and include a regular expression EXCEPT for splunkd.exe for the proc attribute. The way the proc filter works to send everything that matches through, and it drops everything that does not match.

Re: Excluding a process from regmon on Windows

piebob — Thu, 10 Oct 2013 19:03:23 GMT

this assumes you are using a version of splunk older than 6.0. if you're using 6.0, the same procedure applies, but all the changes should be made in a local copy of inputs.conf

see http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorWindowsregistrydata#Filter_incoming_Registry_events

Re: Excluding a process from regmon on Windows

kogane — Thu, 10 Oct 2013 19:10:22 GMT

I've seen the docs. A negative regular expression does not seem to have any impact. Is it supposed to work?

Re: Excluding a process from regmon on Windows

lukejadamec — Thu, 10 Oct 2013 19:13:14 GMT

What is your regex?

Re: Excluding a process from regmon on Windows

kogane — Thu, 10 Oct 2013 19:33:42 GMT

I've gone through a few, but here's the latest one I got from someone at Splunk:

proc = (.(?!\splunkd.exe).)

There are stars after the dots, but they aren't showing up in the comment.

Re: Excluding a process from regmon on Windows

lukejadamec — Thu, 10 Oct 2013 19:45:15 GMT

proc = ^\(?!splunk\.exe).*$

Re: Excluding a process from regmon on Windows

kogane — Fri, 11 Oct 2013 17:15:53 GMT

no luck yet... opened a support case

Re: Excluding a process from regmon on Windows

kogane — Mon, 14 Oct 2013 20:36:51 GMT

Splunk Support came up with a regex that works:

proc = ^(?:(?!ExeNameGoesHere).)*$

Re: Excluding a process from regmon on Windows

piebob — Mon, 14 Oct 2013 20:41:39 GMT

for context, please see the other Answer to this question.