All Apps and Add-ons

Syslog file format not matching with props.conf for SecureAuth IdP?

youngca5
Engager

So we are trying to implement the SecureAuth IdP app in our environment. We are able to get log files to generate out from SecureAuth, but when we are ingesting them into splunk no meaningful fields are extracted.

Currently in SecureAuth, we are using version 8.2, we have the "Syslog" option selected for Audit Logs, and when the file is ingested, we do not match up with any of the extractions in props.conf. Has anyone else had this issue, or know if there is a setting in SecureAuth to make the log file match the format splunk is expecting?

abeeber_2
Path Finder

I had this issue and it turns out the problem was with rsyslog.

rsyslog by default uses BSD for its log format. To get it to handle IEFT which is required by SecureAuth, I had to change the log format template to:

$ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

As soon as did that, all the field extractions worked as expected.

abeeber_2
Path Finder

Did you find an answer to this question?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...