All Apps and Add-ons

Splunk Add-on for Unix and Linux: Which inputs should I enable to monitor audit/auth logs in Linux systems?



I'm setting up forwarders for a number of Linux systems. I will be monitoring user login/authentication and audits to those servers. At first I was logging logs from /var/log/secure and /var/log/messages. Now I was thinking of using the nix app with enabling the following inputs instead of during my recent setup.

The following is the list of inputs I will be enabling.

  • Information of all users currently logged in via the who command ( scripted input).
  • Audit information recorded by the auditd daemon to /var/log/audit/audit.log ( scripted input).
  • Last login times for system accounts via the last command ( scripted input).

Will the information of the inputs suffice our case? Just want to know if also anyone have a same setup.

0 Karma


Id still monitor /var/log/secure and /var/log/messages too but put them in a separate index. Then compare your indexes after a while and see if they both contain what you're looking for. If they each have a little of something you're looking for, keep your current setup and the new unix/linux add on's inputs as well.


0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...