Hi Guys,
I want to prevent the /var/log/audit/audit.log file from being indexed from one particular server. How would I do this and not affect it being indexed on other servers? Would I have to change anything in the *Nix app or would it be a local inputs.conf setting?
Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.
# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0
If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server
Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?
The file I updated was /opt/splunk/etc/system/local/inputs.conf
Could there be another file that takes priority over this?
Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.
# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0
If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server
Did you make this change on the indexer, or on the system with the forwarder?
Why did you make this change in system/local, and not in the etc/apps folder?
Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?
The file I updated was /opt/splunk/etc/system/local/inputs.conf
Could there be another file that takes priority over this?