All Apps and Add-ons

How to prevent /var/log/audit/audit.log from being indexed using *Nix app

tbalouch
Path Finder

Hi Guys,

I want to prevent the /var/log/audit/audit.log file from being indexed from one particular server. How would I do this and not affect it being indexed on other servers? Would I have to change anything in the *Nix app or would it be a local inputs.conf setting?

0 Karma
1 Solution

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

View solution in original post

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

lukejadamec
Super Champion

Did you make this change on the indexer, or on the system with the forwarder?
Why did you make this change in system/local, and not in the etc/apps folder?

0 Karma

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...