topic start tail monitoring windows event log upon Splunk install in Installation

start tail monitoring windows event log upon Splunk install

BunnyHop — Mon, 15 Mar 2010 20:48:55 GMT

What should I attach to my install script if I want to start monitoring the event log in "tail" mode. I don't want to grab any historical events on the first time the LWF runs on the client machines.

I have this as an install script:

msiexec.exe /i %SPLUNK_MSI% LAUNCHSPLUNK=0 WMICHECK_CPUTIME=0 WMICHECK_LOCALDISK=0 WMICHECK_FREEDISK=0 WMICHECK_MEMORY=0 WINEVENTLOGAPPCHECK=0 WINEVENTLOGSECCHECK=1 WINEVENTLOGSYSCHECK=0 /QUIET

This will successfully enable the Security event log on windows, but will capture the historical events.

Re: start tail monitoring windows event log upon Splunk install

jrodman — Tue, 16 Mar 2010 05:20:28 GMT

I don't think the requisite flag, current_only, is exposed in the WMI interface. You will need to do one of:

Manually (possibly by script) tweak the inputs.conf post-install, but this will not prevent splunk from starting to pull the eventlog when it's first started. Since you are setting LAUNCHSPLUNK=0, this should be achivable before the first start.
Alternatively, leave all the inputs disabled, but configure your hosts as deployment clients. Then you can deliver an inputs.conf tailored to your needs via that method. Unfortunately deployment client configuration isn't triggerable via the MSI commandline.

Re: start tail monitoring windows event log upon Splunk install

BunnyHop — Tue, 16 Mar 2010 08:01:43 GMT

Is there a way to append the inputs.conf? I can possibly disable all inputs from the install and then have another line in the script to copy the /etc/ files. I don't to override the inputs.conf file that splunk creates during installation, since that contains the hostname of the client.

I'm using the free splunk so I can't utilize the deployment server/client environment.

Re: start tail monitoring windows event log upon Splunk install

gkanapathy — Tue, 23 Mar 2010 04:45:26 GMT

You should use configuration files immediately after running the installer to set this up. See either: http://answers.splunk.com/questions/434/can-i-auto-install-or-deploy-splunk-onto-all-my-remote-windows-servers/437#437 or http://www.splunk.com/wiki/Deploy:SplunkForwarder_for_Windows_installscript for an example of a script that installs and lays down any desired configuration on top.

Re: start tail monitoring windows event log upon Splunk install

BunnyHop — Tue, 23 Mar 2010 23:01:09 GMT

This works, however, when the service starts for the first time, it overrides the files I've placed...i.e. I created an inputs.conf that has certain attributes, after the splunk service starts, it replaced my custom inputs.conf, it did not append it as I expected.

Re: start tail monitoring windows event log upon Splunk install

gkanapathy — Wed, 24 Mar 2010 21:32:23 GMT

where did you put your custom file? etc/system/local would be the wrong place.

Re: start tail monitoring windows event log upon Splunk install

BunnyHop — Sat, 27 Mar 2010 00:07:15 GMT

Yes that's where i put my file. Where would be the better spot?

Re: start tail monitoring windows event log upon Splunk install

gkanapathy — Sat, 27 Mar 2010 23:56:09 GMT

etc/apps/search/local