https://community.splunk.com/t5/Splunk-Search/snare-running-windows-sending-data-to-linux-splunk-server/m-p/104119#M183140 <P>guys</P> <P>I want to capture the windows event logs running on my windows servers from a linux server running linux.</P> <P>Can it be done with snare?</P> <P>marc</P> Tue, 14 Dec 2010 03:53:26 GMT mritorto 2010-12-14T03:53:26Z https://community.splunk.com/t5/Splunk-Search/snare-running-windows-sending-data-to-linux-splunk-server/m-p/104119#M183140 <P>guys</P> <P>I want to capture the windows event logs running on my windows servers from a linux server running linux.</P> <P>Can it be done with snare?</P> <P>marc</P> Tue, 14 Dec 2010 03:53:26 GMT https://community.splunk.com/t5/Splunk-Search/snare-running-windows-sending-data-to-linux-splunk-server/m-p/104119#M183140 mritorto 2010-12-14T03:53:26Z https://community.splunk.com/t5/Splunk-Search/snare-running-windows-sending-data-to-linux-splunk-server/m-p/104120#M183141 <P>If your interested in the standard set of Event Logs/Active Directory/DNS/DHCP logs, then absolutely and it works well on everything up to and including Windows 2008R2. However, if you need to get any WMI data out of the servers, then consider using the splunk light weight forwarder and read the doc's on how to implement. </P> <P>In my environment Windows Snare clients send tcp to a syslog-ng server on the same RHEL Linux box as Splunk resides. syslog-ng sends to Splunk and is the records manager for log retention. Snare client can be deployed via .exe or by .msi &amp; group policy or via a third party tool like LANDesk. Need to make sure your Group Policy Auditing is tight and need to tweak the out of the box Snare objectives to get the detail you want. One advantage from my point of view is that logs from Snare are a single line syslog format and comingles well with CISCO data that I also retrieve/index. </P> Tue, 14 Dec 2010 21:25:23 GMT https://community.splunk.com/t5/Splunk-Search/snare-running-windows-sending-data-to-linux-splunk-server/m-p/104120#M183141 MikeyG 2010-12-14T21:25:23Z https://community.splunk.com/t5/Splunk-Search/snare-running-windows-sending-data-to-linux-splunk-server/m-p/104121#M183142 <P>I got it work with sname for the event logs.</P> <P>How do I do dhcp or any other application logs</P> Tue, 14 Dec 2010 23:55:19 GMT https://community.splunk.com/t5/Splunk-Search/snare-running-windows-sending-data-to-linux-splunk-server/m-p/104121#M183142 mritorto 2010-12-14T23:55:19Z