How to troubleshoot why Windows event logs are not making into the target index?

davidjohnbecket — Thu, 11 Aug 2016 18:32:51 GMT

We are monitoring for specific Windows events on our Domain Controllers.
Inputs.conf looks like this:

[WinEventLog://Security]
disabled = 0
index = winevents
start_from = oldest
current_only = 0
checkpointInterval = 5
whitelist = 4728,4729,4732,4733,4756,4757,4755

Whe I add a test user to a universal security group, I trigger an event in the security log:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/11/2016 3:22:50 PM
Event ID:      4756
Task Category: Security Group Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      xxxxxxxxxxxx
Description:
A member was added to a security-enabled universal group.

Subject:
    Security ID:        LONDON\xxxxxxxxxxxx
    Account Name:       xxxxxxx
    Account Domain:     LONDON
    Logon ID:       0x86xxxx

Member:
    Security ID:        LONDON\splunk_test
    Account Name:       CN=Splunk Test Log Generator UK,OU=xxx,OU=Test Area,OU=xxx,OU=OIAL,DC=xxx,DC=xxx,DC=xxx

Group:
    Security ID:        LONDON\xxxxxx
    Account Name:       xxxxxxxxxxxx
    Account Domain:     LONDON

Additional Information:
    Privileges:     -

Event Xml:

Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
EventID>**4756**

etc etc

But this event never makes it into the index.
No errors on the splunkd log.
What am i missing?

Re: How to troubleshoot why Windows event logs are not making into the target index?

maciep — Tue, 16 Aug 2016 01:15:12 GMT

That seems to look right. What version of Splunk? Do you get any events from the dc in Splunk (internal events included)? Any other events from the event log on that dc? Any event log events from any forwarders? Where is your inputs.conf located?

topic Re: How to troubleshoot why Windows event logs are not making into the target index? in Getting Data In

How to troubleshoot why Windows event logs are not making into the target index?

Re: How to troubleshoot why Windows event logs are not making into the target index?