All Apps and Add-ons

How to prevent /var/log/audit/audit.log from being indexed using *Nix app

tbalouch
Path Finder

Hi Guys,

I want to prevent the /var/log/audit/audit.log file from being indexed from one particular server. How would I do this and not affect it being indexed on other servers? Would I have to change anything in the *Nix app or would it be a local inputs.conf setting?

0 Karma
1 Solution

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

View solution in original post

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma

somesoni2
Revered Legend

Update the inputs.conf file on the particular server and remove ( or set disabled = 1) for below stanza.

# This script reads the auditd logs translated with ausearch
[script://./bin/rlog.sh]
sourcetype = auditd
source = auditd
interval = 60
index = os
disabled = 0

If you use deployment server to push this apps onto servers, have two version of the app and send the one with this stanza disabled to that particular server

lukejadamec
Super Champion

Did you make this change on the indexer, or on the system with the forwarder?
Why did you make this change in system/local, and not in the etc/apps folder?

0 Karma

tbalouch
Path Finder

Thanks I went ahead and did this, but i still keep getting tons of auditd events. The only way I could suppress them was by acutally disabling the auditd server on the server. Is there any other file that I would need to put this into?

The file I updated was /opt/splunk/etc/system/local/inputs.conf

Could there be another file that takes priority over this?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...