All Apps and Add-ons

How can I monitor TMG logs?

kiran331
Builder

Hi

I have to monitor TMG logs in the path D:\tmglogs. I have to separate the logs by sourcetypes, if it has FWS its firewall and WEB its proxy. What changes are to be made in input.conf to get the two sourcetypes based on the filename?
And the new files are created daily, how can I monitor only the files created today?

D:\tmglogs\ISALOG_20161006_FWS_000.w3c
D:\tmglogs\ISALOG_20161005_WEB_000.w3c

current configuration in input.conf:

Forefront TMG Firewall logs

Modify paths to fit your needs

[monitor://D:\tmglogs*.w3c]
sourcetype = microsoft:forefront:tmg:fw
index=tmg

Forefront TMG Proxy logs

Modify paths to fit your needs

[monitor://D:\tmglogs*.w3c]]

sourcetype = microsoft:forefront:tmg:proxy

0 Karma
1 Solution

mikaelbje
Motivator
#Forefront TMG Firewall logs
# Modify paths to fit your needs
[monitor://D:\tmglogs\ISALOG_*_FWS_000.w3c]
sourcetype = microsoft:forefront:tmg:fw
ignoreOlderThan = 24h
index=tmg

#Forefront TMG Proxy logs
# Modify paths to fit your needs
[monitor://D:\tmglogs\ISALOG_*_WEB_000.w3c]
sourcetype = microsoft:forefront:tmg:proxy
ignoreOlderThan = 24h
index=tmg

I believe that should work

View solution in original post

mikaelbje
Motivator
#Forefront TMG Firewall logs
# Modify paths to fit your needs
[monitor://D:\tmglogs\ISALOG_*_FWS_000.w3c]
sourcetype = microsoft:forefront:tmg:fw
ignoreOlderThan = 24h
index=tmg

#Forefront TMG Proxy logs
# Modify paths to fit your needs
[monitor://D:\tmglogs\ISALOG_*_WEB_000.w3c]
sourcetype = microsoft:forefront:tmg:proxy
ignoreOlderThan = 24h
index=tmg

I believe that should work

kiran331
Builder

Hi, its still getting all logs under sourcetype = microsoft:forefront:tmg:fw.

0 Karma

kiran331
Builder

Its working! Thanks a lot

0 Karma

mikaelbje
Motivator

Great! If you need this to be CIM compliant then get tags.conf from https://github.com/inspired/TA-Microsoft_Forefront_TMG/blob/master/default/tags.conf

I believe it is missing in the app I posted on Splunkbase. If you don't need CIM then don't bother 🙂

Please also rate the app on Splunkbase if you find it useful

0 Karma

kiran331
Builder

Thanks! Any idea what kind of Dashboard's can be done with tmg logs

0 Karma

mikaelbje
Motivator

Since the add-on is CIM compliant you can use the Web data models in the Splunk Common Information Add-on (available at Splunkbase). Enterprise Security will also be able to leverage these logs out of the box. I guess top domains, top users, top user agents etc could be interesting data to show in your dashboard

0 Karma
Get Updates on the Splunk Community!

Splunk Certification Support Alert | Pearson VUE Outage

Splunk Certification holders and candidates!  Please be advised of an upcoming system maintenance period for ...

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...