- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I am new to Splunk and now am using using splunk 6.2 on Linux. A few days ago, I configured SEP to forward all Events (Client, System, Agents, etc.)
From the Splunk side, I've downloaded and added the Splunk Add-on for Symantec Endpoint Protection 2.0.1.
All network access are OK, and tested, but I don't know if the logs were sent from SEP or not or where and how to find it. I'm totally naive to SPLUNK. I have followed configuration steps, but I didn't find the logs on "$SEPM_HOME/data/dump"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The list of possible problems is myriad... I'll assume it isn't sophons. Let's start with determining if it's a Splunk problem:
index=_internal
That search will show you all of Splunk's own logs. Most likely you'll see your own searches, your login to the system, and some housekeeping messages. Add "ERROR" to the search, and you'll see any problems.
If you don't see anything like "I am receiving your logs and throwing them on the floor because they're smelly", then it's probably not a Splunk problem. My guess is that you're trying to open a syslog port that the OS or its firewall isn't going to allow. Try using a port number over 1024 and allowing it through your firewall.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On your SEP server, your logs should be in the following directory:
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection Manager\data\dump
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The list of possible problems is myriad... I'll assume it isn't sophons. Let's start with determining if it's a Splunk problem:
index=_internal
That search will show you all of Splunk's own logs. Most likely you'll see your own searches, your login to the system, and some housekeeping messages. Add "ERROR" to the search, and you'll see any problems.
If you don't see anything like "I am receiving your logs and throwing them on the floor because they're smelly", then it's probably not a Splunk problem. My guess is that you're trying to open a syslog port that the OS or its firewall isn't going to allow. Try using a port number over 1024 and allowing it through your firewall.
