How to prevent /var/log/audit/audit.log from being indexed using *Nix app

[tbalouch]

Hi Guys,

I want to prevent the /var/log/audit/audit.log file from being indexed from one particular server. How would I do this and not affect it being indexed on other servers? Would I have to change anything in the *Nix app or would it be a local inputs.conf setting?

[tbalouch]

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

[somesoni2 · Accepted solution]

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

[lukejadamec]

Did you make this change on the indexer, or on the system with the forwarder?
Why did you make this change in system/local, and not in the etc/apps folder?

[tbalouch]

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?