topic Re: Splunk not ingesting some log files in Getting Data In

Splunk not ingesting some log files

user789 — Wed, 22 Apr 2020 16:01:08 GMT

I have set splunk to ingest the /var/log directory. On this particular host, I go to filter by "source", and only see 2 sources:

/var/log/messages
/var/log/maillog

Why is it not seeing other files and folders? For example, there is /var/log/audit/audit.log.

Re: Splunk not ingesting some log files

richgalloway — Wed, 22 Apr 2020 17:07:09 GMT

Does the account running Splunk have read access to the missing files? Often, files in /var/log are secured so only root can read them.

Re: Splunk not ingesting some log files

user789 — Wed, 22 Apr 2020 17:12:30 GMT

Splunk is running as "sudo", so this should be fine, right?

Re: Splunk not ingesting some log files

richgalloway — Wed, 22 Apr 2020 18:17:02 GMT

"fine" as in able to read the files, yes. "fine" as in a good way to run Splunk, no. Running Splunk (or any non-OS process) as root increases your attack surface.

Re: Splunk not ingesting some log files

user789 — Thu, 23 Apr 2020 12:06:19 GMT

So splunk is able to read these files and into directories, yet they are not populating on the splunk server.

Re: Splunk not ingesting some log files

richgalloway — Fri, 24 Apr 2020 13:36:18 GMT

Search index=_internal to verify the forwarder is sending data to the indexers. Verify you are looking in the right index for the data.

Re: Splunk not ingesting some log files

user789 — Thu, 14 May 2020 20:07:44 GMT

I ran the query for index=_internal, and I do not see any of my hosts showing up.