All Apps and Add-ons

How to prevent /var/log/audit/audit.log from being indexed using *Nix app

tbalouch
Path Finder

Hi Guys,

I want to prevent the /var/log/audit/audit.log file from being indexed from one particular server. How would I do this and not affect it being indexed on other servers? Would I have to change anything in the *Nix app or would it be a local inputs.conf setting?

0 Karma
1 Solution

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

View solution in original post

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

lukejadamec
Super Champion

Did you make this change on the indexer, or on the system with the forwarder?
Why did you make this change in system/local, and not in the etc/apps folder?

0 Karma

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...