topic Editing Splunk Logs in Getting Data In

Editing Splunk Logs

ceichhorn — Tue, 29 Apr 2014 21:32:48 GMT

I'm testing whether event logs in Splunk can be edited and, if so, if those changes are themselves logged. For instance, if Splunk service is turned off, can the logs be edited? And if so, when Splunk turns back on, does it alert in any way that the logs have been changed? Thanks in advance for any information.

Re: Editing Splunk Logs

lguinn2 — Tue, 29 Apr 2014 22:24:51 GMT

What do you mean by "event logs in Splunk?"

Do you mean the Splunk logs like splunkd.log or other logs like the Windows Event logs?

Re: Editing Splunk Logs

MuS — Wed, 30 Apr 2014 05:26:54 GMT

Hi ceichhorn,

Splunk does not check if its own logs have been edited somehow.

But, you can enable file auditing in your OS and index the results of the audit on the Splunk logs like splunkd.log or audit.log. Based on that you can also setup some alerts in Splunk, so you will get notified if there was some edits on the Splunk logs.

See some examples on how to enable auditing for Linux or Windows. Linux auditing messages can get by scripted input into Splunk and Windows auditing messages will by in the Windows Security Events.

hope this helps ...

cheers, MuS