topic Re: Force Re-Enumeration of all AD objects with ADmon? in Getting Data In

Force Re-Enumeration of all AD objects with ADmon?

Jason — Wed, 26 Jan 2011 03:16:57 GMT

From my understanding, ADmon will pull down all objects in AD on first run, then only report changes from then on. However, the original baseline data will get lost when it ages out of an index.

Is there a way to force ADmon to re-enumerate all AD objects to get a proper baseline, occasionally?

Re: Force Re-Enumeration of all AD objects with ADmon?

Jason — Fri, 28 Jan 2011 04:21:00 GMT

(Without completely clearing fishbucket.)

Re: Force Re-Enumeration of all AD objects with ADmon?

rgopalan — Fri, 28 Jan 2011 05:30:49 GMT

You could do one of the following to re-sync the events from the server.

i) Manually add another stanza in etc\...\local\admon.conf like so:

[newCollection]
targetDc = "your Server here"
startingNode = 
monitorSubtree = 1
disabled = 0

ii) Use Splunkweb to add the new collection with the same settings as the old one.

iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon there is a file called "your collection name here.ini". Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate.

Re: Force Re-Enumeration of all AD objects with ADmon?

Jason — Tue, 01 Feb 2011 23:25:14 GMT

I have not been able to test this, but am going to mark this as accepted. If anyone is able to test this, please comment!

Re: Force Re-Enumeration of all AD objects with ADmon?

helge — Wed, 05 Mar 2014 14:14:54 GMT

Deleting the INI files is the way to go!

Re: Force Re-Enumeration of all AD objects with ADmon?

helge — Wed, 05 Mar 2014 14:15:43 GMT

Should it not be "inputs.conf" instead of "admon.conf"?

Re: Force Re-Enumeration of all AD objects with ADmon?

maraman_splunk — Fri, 27 Jan 2017 09:06:42 GMT

Yes

method 1 worked for me :
modify input app deployed on UF locally on AD :
in inputs.conf
change the admon collection name [admon:collection2]
used baseline=1
disabled=0
targetDC = "myAD"
index=myindex
monitorSubtree=1

push to uf
then wait for baseline to complete
then change baseline to 0 and repush to uf

This way is easier when you don't have local access on the AD to clean up files