topic Re: How to prevent internal Splunk audit logs from being written to /var/log/audit? in Getting Data In

How to prevent internal Splunk audit logs from being written to /var/log/audit?

jravida — Mon, 18 Aug 2014 16:33:53 GMT

Hi folks,

So I am running a distributed deployment. It seems that, on my index server (running RedHat), SPlunk is sending loads of internal audit events to /var/log/audit/audit.log. I am not indexing this nor do I care about the large volumes of information Splunk is logging here. It ends up filling 50MB of space per hour.

Is there a mechanism to prevent all these logs from writing to the audit log on my server?

Re: How to prevent internal Splunk audit logs from being written to /var/log/audit?

yannK — Mon, 18 Aug 2014 16:39:39 GMT

Yes the log rotation defined in $SPLUNK_HOME/etc/log.cfg

Splunk will maintain 5 rotated copies of 25MB each of the audit.log, so the maximum will be 125MB.

Re: How to prevent internal Splunk audit logs from being written to /var/log/audit?

ppablo — Mon, 18 Aug 2014 16:50:14 GMT

Hi @jravida

If you want to prevent certain logs from being indexed in Splunk, you can configure inputs.conf with blacklist rules. Check out the following documentation on whitelist and blacklist monitoring. http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Whitelistorblacklistspecificincomingdata

Re: How to prevent internal Splunk audit logs from being written to /var/log/audit?

jravida — Mon, 18 Aug 2014 17:28:07 GMT

The logs aren't being index from what I can tell. They are just getting saved to the filesystem.

Re: How to prevent internal Splunk audit logs from being written to /var/log/audit?

ppablo — Mon, 18 Aug 2014 23:46:56 GMT

Ah sorry @jravida I didn't catch that part.

Re: How to prevent internal Splunk audit logs from being written to /var/log/audit?

mad4wknds — Mon, 10 Apr 2017 22:07:15 GMT

I know that this is a very old post but I think this is the answer. Change the audit rules for auditing splunk directories
echo "# Exclude Splunk directories" >> /etc/audit/audit.rules
echo "-W never,exit -F path=/app/splunk/ -k exclude" >> /etc/audit/audit.rules
echo "-W never,exit -F path=/data1/splunk/ -k exclude" >> /etc/audit/audit.rules
echo "-W never,exit -F path=/data2/splunk/ -k exclude" >> /etc/audit/audit.rules