All Apps and Add-ons

Why are CIM fields missing fields for ESXi audit events?

_joe
Communicator

Hello all,

I suspect I am missing something obvious, but where are all the CIM fields for ESXi audit logs?

 

- I have VMware logs being sent to a syslog port. Have a mix of vmware 7.0 and 6.7 vcenters (Splunk 8.2)
# https://docs.splunk.com/Documentation/AddOns/released/VMW/ESXihosts
- I am using the latest Splunk Add-on for VMware ESXi Logs (4.2.1)
- I have had to modify line breaking rules
- I have an index cluster, so I had to update the DATETIME_CONFIG field (from .../apps/... to slave_apps)
- I am capturing the hostname via rsyslog and putting into into the directory. I am reading it as my host value

(example: /var/log/vmware/hostname/day_hour/log.log)
- I am capturing logs as "vmw-syslog," logs are being renamed to things such as "vmware:esxlog:vpxd" by the TA


The TA as-is captures application and message fields for most events. But I don't see any configurations that would capture a user or action field, CIM fields or tags for login events, etc. Am I missing something?

I am seeing logs that look like this, but no attempt to parse CIM fields:


2022-04-21T17:37:17.686700+00:00 <host> vpxd 3115 - - Event [49110010] [1-1] [2022-04-21T17:37:17.685845Z] [vim.event.UserLogoutSessionEvent] [info] [AD\<user>] [] [49111254] [User AD\<user>@127.0.0.1 logged out (login time: Thursday, 21 April, 2022 05:27:42 PM, number of API invocations: 1, user agent: VMware vim-java 1.0)]

 

2022-04-21T17:27:42.654618+00:00 <host> vpxd 3115 - - Event [49109228] [1-1] [2022-04-21T17:27:42.654052Z] [vim.event.UserLoginSessionEvent] [info] [AD\<user>] [] [49104519] [User AD\<user>@127.0.0.1 logged in as VMware vim-java 1.0]

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...