All Apps and Add-ons

Syslog file format not matching with props.conf for SecureAuth IdP?


So we are trying to implement the SecureAuth IdP app in our environment. We are able to get log files to generate out from SecureAuth, but when we are ingesting them into splunk no meaningful fields are extracted.

Currently in SecureAuth, we are using version 8.2, we have the "Syslog" option selected for Audit Logs, and when the file is ingested, we do not match up with any of the extractions in props.conf. Has anyone else had this issue, or know if there is a setting in SecureAuth to make the log file match the format splunk is expecting?

Path Finder

I had this issue and it turns out the problem was with rsyslog.

rsyslog by default uses BSD for its log format. To get it to handle IEFT which is required by SecureAuth, I had to change the log format template to:

$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

As soon as did that, all the field extractions worked as expected.

Path Finder

Did you find an answer to this question?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!