topic Re: Problems to collect data from Domain Controller (Active Directory) in Getting Data In

Problems to collect data from Domain Controller (Active Directory)

jcrival — Sun, 14 Sep 2014 16:49:33 GMT

Hi Guys,

I have configured Splunk App for Windows Infraestructure on my Splunk Indexer. I also installed splunkforwarders on the remote servers and on the Domain Controller (Windows 2008 R2). I also copied the addons but i am not able to display the Domain Controller´s event logs (applications, system and security)

The splunkd.log I got this error

9-13-2014 18:14:19.519 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='File Replication Service'
09-13-2014 18:14:19.519 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - Processing: 'blacklist1', failed to find delimeter '4' in regex '4662 Message="Object Type:\s+(?!groupPolicyContainer)"' for key 'EventCode '. Discarding.
09-13-2014 18:14:19.519 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - Processing: 'blacklist2', failed to find delimeter '5' in regex '566 Message="Object Type:\s+(?!groupPolicyContainer)"' for key 'EventCode '. Discarding.

Could you please help me out with the correct configuration

Regards,

Jose C. Rivera

Re: Problems to collect data from Domain Controller (Active Directory)

MarioM — Mon, 15 Sep 2014 12:15:58 GMT

Can you give the versions of : Splunk App for Windows Infraestructure,Splunk Indexer,splunkforwarders?

Re: Problems to collect data from Domain Controller (Active Directory)

jcrival — Mon, 15 Sep 2014 13:59:35 GMT

Hi Mario
Here the versions:

Splunk forwarder on Domain Controller: splunkforwarder-6.1.3-220630-x64-release.msi
Splunk Indexer (Windows 7): Splunk 6.1.2 (build 213098)
Splunk App for Windows Infrastructure: splunk-app-for-windows-infrastructure_103
Splunk addon for microsoft: splunk-add-on-for-microsoft-windows_471

Regards,

Jose Carlos

Re: Problems to collect data from Domain Controller (Active Directory)

michaelstillmun — Tue, 28 Jun 2016 16:51:00 GMT

Jose,

When you see an WinEventMon:: error stating it is unable to find the Log with channel name="foo" often means the the Event Log Name is named differently then what is configured in your forwarder's inputs.conf stanza.

Also the "File Replication Service" is considered a non-default Windows event log. You must import them to the Windows Event Viewer.

After you import the log, you can add them to your forwarder's local copy of inputs.conf, as follows:

[WinEventLog://File Replication Service]
disabled = 0

Regards,
Michael Stillmunks

Re: Problems to collect data from Domain Controller (Active Directory)

michaelstillmun — Tue, 28 Jun 2016 17:32:16 GMT

Also the "File Replication Service" is considered a non-default Windows event log. You must import them to the Windows Event Viewer.

After you import the log, you can add them to your forwarder's local copy of inputs.conf, as follows:

[WinEventLog://File Replication Service]
disabled = 0

This may fix both problems, if not double-check your Regex statement for accuracy.

A issue I had was I needed to monitor workstation cdrom usage. For my forwarder's inputs.conf is was using the following stanza:

[WinEventLog://Microsoft-Windows-CDROM]
disabled = 0

But if you take a look at the logs using poweshell: Get-WinEvent -ListProvider cdrom you see:

PS C:\> Get-WinEvent -ListProvider cdrom

Name     : cdrom
LogLinks : {System}
Opcodes  : {}
Tasks    : {}

Name     : Microsoft-Windows-CDROM
LogLinks : {Microsoft-Windows-CDROM/Operational}
Opcodes  : {win:Info}
Tasks    : {CDROM_DRIVER}

Looking at the LogLinks, I see I needed to use the System log and proper event codes. Changed my stanza to reflect looking at the system log and to blacklist all but the code i wanted:

[WinEventLog://System]
disabled=0
blacklist1= 0-112,114-99999

Regards,
Michael Stillmunks