topic Re: Huge logs not getting stopped in Splunk Search

Huge logs not getting stopped

udayk1 — Thu, 01 May 2014 04:19:46 GMT

We have one server which sends many logs say per hour 4000 logs which are not required i.e. event ID of 560 and 562. As we don't want these logs we have disabled the auditing in the respective server, since it was of no luck we were still receiving the logs.
Post which we disabled and uninstalled Splunk Forwarder, uninstalled the respective software which sends logs to Splunk and also we are seeing huge logs of that particular server. Anywhere else we need to disable?

Re: Huge logs not getting stopped

udayk1 — Thu, 01 May 2014 04:33:36 GMT

Sorry it is not 4000 per hour, it is per minute

Re: Huge logs not getting stopped

Ayn — Thu, 01 May 2014 07:22:12 GMT

Do you mean that you're still seeing new events from this server despite that you have inactivated these events and also uninstalled the forwarder there? That seems...highly unlikely unless you did something seriously wrong...

Re: Huge logs not getting stopped

udayk1 — Thu, 01 May 2014 10:55:16 GMT

This has been solved.

Re: Huge logs not getting stopped

davidpaper — Sun, 04 May 2014 17:28:25 GMT

What was the solution?

Re: Huge logs not getting stopped

splunker12er — Sun, 04 May 2014 18:23:29 GMT

Not at all possible. when a software doesnt exit/uninstalled how can it do its job ?!