All Apps and Add-ons

Stop logging windows replication - sourcetype = MSAD:NT6:Replication

schultet
Path Finder

Is there a way to stop the flood of windows replication log entries - I think I would only need to know on failures

Thanks
Tom

0 Karma
1 Solution

schultet
Path Finder

In accordance with one of installation guidelines I added these apps to each of my domain controllers" TA-DNSServer-NT6 and TA_DomianController-NT6

When I removed these apps the Replication , Site Info and Health logging stopped.

View solution in original post

0 Karma

schultet
Path Finder

In accordance with one of installation guidelines I added these apps to each of my domain controllers" TA-DNSServer-NT6 and TA_DomianController-NT6

When I removed these apps the Replication , Site Info and Health logging stopped.

0 Karma

schultet
Path Finder

No Repsonse yet. hmmmm. Anybody know how to stop the flood of these events

sourcetype = MSAD:NT6:Health

sourcetype = MSAD:NT6:SiteInfo

0 Karma

schultet
Path Finder

So I am norrowing in on the culprit - I have disable all logging related to Replication on my Domain Controllers but still getting 10,000s replication, DNS siteinfo and Health reports daily.

The source = Powershell finally tipped me off that there is no PowerShell event log that I can find in the Windows event viewer. Doing some more google-foo and found a blog about Splunk server executing Powershell commands
http://blogs.splunk.com/?s=powershell+replication

Does anybody know where these powershell commands are located and if I can modify or stop them all together?

0 Karma

schultet
Path Finder

And if you do know how - Id like to be able to get any failed replication events or failed DNS events just not 10,000 information events per server per day

0 Karma

schultet
Path Finder

So simply doing a search on my Splunk server with the word "Powershell" I found some scripts in:

E:\Program Files\Splunk\etc\apps\splunk_app_windows_infrastructure\appserver\addons\common\bin
E:\Program Files\Splunk\etc\apps\splunk_app_windows_infrastructure\appserver\addons\TA-DNSServer-NT5\bin\powershell
E:\Program Files\Splunk\etc\apps\splunk_app_windows_infrastructure\appserver\addons\TA-DNSServer-NT6\bin
E:\Program Files\Splunk\etc\apps\splunk_app_windows_infrastructure\appserver\addons\TA-DomainController-NT6\bin

Like this one: ad-repl-stat.ps1

Import-Module ActiveDirectory -ErrorAction SilentlyContinue
Get-ADReplicationPartnerMetaData -Target $env:ComputerName -PartnerType Inbound -Partition * | %{
$src_host = Get-ADObject -Filter * -SearchBase $.Partner.Replace("CN=NTDS Settings,","") `
-SearchScope Base -Properties dNSHostName
New-Object PSObject -Property @{
LastAttemptedSync = $
.LastReplicationAttempt
LastSuccessfulSync = $.LastReplicationSuccess
type = "ReplicationEvent"
usn = $
.LastChangeUsn
src_host = $src_host.dNSHostName
Result = $.LastReplicationResult
transport = $
.IntersiteTransportType
naming_context = $_.Partition
}

}

I have both 2008R2 and 2012R2 Domain Controllers - I'm not sure which scripts need to be modified and if they need to be modified on the Splunk Server or on the Domain Controllers. Any help or direction would be appreciated

0 Karma

schultet
Path Finder

I may have found the answer: Settings --> Data Inputs --> Scripts

I disable these three scripts

E:\Program Files\Splunk\etc\apps\TA-DomainController-NT6\bin\runpowershell.cmd ad-health.ps1

E:\Program Files\Splunk\etc\apps\TA-DomainController-NT6\bin\runpowershell.cmd ad-repl-stat.ps1

E:\Program Files\Splunk\etc\apps\TA-DomainController-NT6\bin\runpowershell.cmd siteinfo.ps1

0 Karma

schultet
Path Finder

NOPE! Still getting these I even renamed the scripts in the folder. There is some sort of bug here. I will need to open a case with support I guess. Cheers! Yay!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...