Ambiguous Question: Splunk AD App logging levels

[SplunkFu]

Hi,

We are looking at using the Splunk for Active Directory App in our deployment, but this may take a bit of time due to paperwork/restrictions, etc.

In the mean time we are also reviewing our license usage, and I expect the increased logging of this App to impact the license. We are currently collecting the Sec/App/Sys Event logs from the DC's, and are looking to estimate the new logging levels (if that is even possible). I was wondering if anyone could take a stab at answering the following (again I know this would be specific to our estate, etc. and is very ambiguous):

1. Has anyone gone through a similar transistion and can detail the increase in logging?
2. Has anyone implemented the app and can details what logging they see from one DC?
3. Anyone provide any other advice

Thanks in advance,

P.S. I know this isn't the best question in the world!

[ahall_splunk · Accepted solution]

Together with the Security logs, the splunk app for active directory generates about 4-6Gb per 1000 users in the environment per day. The differential depends on the number of servers and managed services in the environment a little bit, but it also depends on whether your domain controllers and DNS servers have windows firewall on (hint: turn it off) and what level of tuning you do to the audit settings. The basic audit settings that are documented actually log more than is required. Turning to advanced audit settings allows you to further tune the audit logs to only what is required, at the expense of a more complex (and undocumented) configuration of Active Directory.

So, not the best answer in the world either, but 4-6Gb/1000-users/day is your answer.

[SplunkFu]

Thanks @ahall_splunk, I understand it is very deployment-specific.