topic Registry Monitoring returning no events in Monitoring Splunk

Registry Monitoring returning no events

kholleran — Fri, 09 Nov 2012 16:28:20 GMT

Hello,

I am trying to monitor the registry of remote forwarders. I have the following in my regmon.conf

[default]
disabled = 0
baseline = 0
#30 days
#baseline_interval = 2592000

# Monitor all registry keys under the HKEY_CURRENT_USER Registry hive for 
# "set," "create," "delete," and "rename" events created by all processes.
# Store the events in the "regmon" splunk index

[USBSTOR]
proc = .*
hive = \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
type = set|create|delete|rename
index = default
baseline = 0
disabled = 0

[USB]
proc = .*
hive = \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Enum\USB
type = set|create|delete|rename
index = default
baseline = 0
disabled = 0

I am trying to monitor when a USB device is plugged in. I am using deployment server to deploy this as an app, I see it show up in deployment-client, & I see the keys showing in the reg input on the forwarder... I then walk to the device, plug in a USB flash drive, watch the registry change, but no events ever show up!

Can anyone see anything I am doing wrong?

Thanks for your help.

Kevin

Re: Registry Monitoring returning no events

kholleran — Tue, 13 Nov 2012 16:11:21 GMT

I see the following in Splunkd.log:

splunk-regmon - WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: PCRE does not support \L, \l, \N{name}, \U, or \u'

Re: Registry Monitoring returning no events

kholleran — Tue, 13 Nov 2012 16:49:14 GMT

I am thinking I need to double-slash to escape. Did this & now I have no errors, but made a change in the registry and nothing is coming across....

Re: Registry Monitoring returning no events

kholleran — Wed, 14 Nov 2012 16:01:59 GMT

Has anyone done anything like this? I want to alert when a new USB device is plugged in....

Thanks.

Re: Registry Monitoring returning no events

kholleran — Wed, 14 Nov 2012 21:02:15 GMT

Someone help!!!! I need to get this to work by tomorrow morning!!! I cannot understand why this is not working!!!

Re: Registry Monitoring returning no events

kholleran — Wed, 14 Nov 2012 23:15:35 GMT

AHHHHH!!!! Fixed... the index line was incorrect as that is not the index I want it going to so that was messing it up.

Re: Registry Monitoring returning no events

r0otux — Thu, 06 Nov 2014 16:36:19 GMT

I realize this post is old, but do you recall what the index line should read or reference to? Thanks in advance for any help.