https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161726#M32803 <P>What was the solution?</P> Mon, 11 Dec 2017 20:32:54 GMT jlemoine 2017-12-11T20:32:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161722#M32799 <P>Has anyone been successful in monitoring Microsoft CA logs on Server 2008 R2? It looks as if they are being written to C:\Windows\System32\CertLog in EDB log format, which is not human readable. I want to say the EDB log format might also be used by Microsoft Exchange, so I don't know if any TA or SA for exchange could be leveraged.</P> <P>Any assistance with this issue would be appreciated.</P> <P>Thanks</P> Tue, 29 Jul 2014 15:39:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161722#M32799 jodros 2014-07-29T15:39:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161723#M32800 <P>early morning bump. No one is monitoring any Microsoft CA servers running on 2008 R2 with Splunk?</P> Wed, 30 Jul 2014 13:05:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161723#M32800 jodros 2014-07-30T13:05:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161724#M32801 <P>Figured out the issue. There was an additional auditing setting that needed to be tweaked in the GPO before the CA events started showing up in the WinEventLog:Security. No need to try and figure out a way to monitor the edb files.</P> Wed, 30 Jul 2014 19:18:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161724#M32801 jodros 2014-07-30T19:18:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161725#M32802 <P>Do you remember what change did you make in GPO in order to collect CerLog like EventCode=64 etc?</P> Tue, 09 Aug 2016 06:14:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161725#M32802 nabeel652 2016-08-09T06:14:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161726#M32803 <P>What was the solution?</P> Mon, 11 Dec 2017 20:32:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161726#M32803 jlemoine 2017-12-11T20:32:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161727#M32804 <P>would be helpful, if you could provide how did you fix this.</P> Tue, 24 Mar 2020 07:27:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-monitor-Microsoft-CA-logs-on-Server-2008-R2/m-p/161727#M32804 thambisetty 2020-03-24T07:27:58Z