All Apps and Add-ons

Why are CIM fields missing fields for ESXi audit events?


Hello all,

I suspect I am missing something obvious, but where are all the CIM fields for ESXi audit logs?


- I have VMware logs being sent to a syslog port. Have a mix of vmware 7.0 and 6.7 vcenters (Splunk 8.2)
- I am using the latest Splunk Add-on for VMware ESXi Logs (4.2.1)
- I have had to modify line breaking rules
- I have an index cluster, so I had to update the DATETIME_CONFIG field (from .../apps/... to slave_apps)
- I am capturing the hostname via rsyslog and putting into into the directory. I am reading it as my host value

(example: /var/log/vmware/hostname/day_hour/log.log)
- I am capturing logs as "vmw-syslog," logs are being renamed to things such as "vmware:esxlog:vpxd" by the TA

The TA as-is captures application and message fields for most events. But I don't see any configurations that would capture a user or action field, CIM fields or tags for login events, etc. Am I missing something?

I am seeing logs that look like this, but no attempt to parse CIM fields:

2022-04-21T17:37:17.686700+00:00 <host> vpxd 3115 - - Event [49110010] [1-1] [2022-04-21T17:37:17.685845Z] [vim.event.UserLogoutSessionEvent] [info] [AD\<user>] [] [49111254] [User AD\<user>@ logged out (login time: Thursday, 21 April, 2022 05:27:42 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)]


2022-04-21T17:27:42.654618+00:00 <host> vpxd 3115 - - Event [49109228] [1-1] [2022-04-21T17:27:42.654052Z] [vim.event.UserLoginSessionEvent] [info] [AD\<user>] [] [49104519] [User AD\<user>@ logged in as VMware vim-java 1.0]

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...