All Apps and Add-ons

How to prevent /var/log/audit/audit.log from being indexed using *Nix app

tbalouch
Path Finder

Hi Guys,

I want to prevent the /var/log/audit/audit.log file from being indexed from one particular server. How would I do this and not affect it being indexed on other servers? Would I have to change anything in the *Nix app or would it be a local inputs.conf setting?

0 Karma
1 Solution

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

View solution in original post

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

lukejadamec
Super Champion

Did you make this change on the indexer, or on the system with the forwarder?
Why did you make this change in system/local, and not in the etc/apps folder?

0 Karma

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...