All Apps and Add-ons

Why is the checkpoint OPSEC LEA app not fetching audit logs?

N92
Path Finder

Here might be I am wrong because when I check the props.conf file I did not find any stanza for audit logs. So how can I proceed further with audit logs?

realsplunk
Motivator

deleting /splunk/var/lib/splunk/modinputs/checkpoint_opseclea/Audit_audit then splunk restart solved the problem.

0 Karma

realsplunk
Motivator

Same problem since upgrade from CP R77 to R80

0 Karma

gmessinger
New Member

I'm not receiving any Audit data either. But, I have seen in the Splunk logs where its trying to grab the logs from fw.adtlog. The problem is my audit data logs roll over every day and its not trying to grab the daily audit logs (only the default fw.adtlog). Example, it's trying to grab audit data from the main logs that roll-over every day (2018-11-05_000000.log, 2018-11-06_000000.log, etc.) and NOT from (2018-11-05_000000.adtlog, 2018-11-06_000000.adtlog). So, I think that's the problem - it recognizes and grabs the NON-Audit data from these daily roll-over logs, but NOT the audit data - because it's not looking for YYYY-MM-DD_XXXX.adtlog as a log to grab info from.

0 Karma

kc64645
Explorer

I am having similar issue where Splunk stops fetching audit logs after midnight when file is rolled over. Did you find any solution for this? Appreciate your help!

0 Karma

p_gurav
Champion

you need to check this file opseclea_inputs.conf in $SPLUNK_HOME/etc/apps/Splunk_TA_checkpoint-opseclea/local.

Refer below document:
https://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Configureinputs

0 Karma

N92
Path Finder

@p_gurav I have added two different connection in inputs.conf 1. Non-audit & 2. Audit for single configuration connection.

0 Karma

splunker12er
Motivator

When two or more data inputs are configured for the same product (e.g. non_audit, firewall,vpn,smartdefense) and follow similar naming convention (e.g input/9, input/19, etc), there is a possibility of race condition as all these inputs refer to the same checkpoint file.

You will see the following warning message: Unable to get a lock or parse the checkpoint file . Will retry on next run.

Your error will be logged in splunk_ta_checkpoint-opseclea_modinput.log and Splunk software will stop indexing data for that particular data input.

Hope this helps to helps

0 Karma

N92
Path Finder

I am not getting any error or warning in modinput.log file. But I am receiving the logs as shown below for audit connection.

log_level=INFO, pid=2919, tid=Thread-16856, file=ta_opseclea_data_collector.py, func_name=get_logs, code_line_no=73 | [input_name="XYZ_Firewall_Audit" connection="XYZ" data="audit"]log_level=2 file:lea_loggrabber.cpp func_name:get_fw1_logfiles_dict code_line_no:2442 :- 2018-03-09_093944_98.log nID 1520585520 aID 1520585520^C

But not able to search in Splunk.

0 Karma

p_gurav
Champion

Can you give inputs.conf file details which you configured?

0 Karma

N92
Path Finder

[NAME 1]
connection = N
data = non_audit
host = XXXXXX
index = checkpoint
interval = 60
mode = online
noresolve = 1
starttime = XXXXXXX
disabled = 0

[NAME 2]
connection = N1
data = non_audit
host = XXXX
index = checkpoint
interval = 60
mode = online
noresolve = 1
starttime = XXXXXXX
disabled = 0

[NAME 3]
connection = N2
data = non_audit
host = XXXXX
index = checkpoint
interval = 60
mode = offline
noresolve = 1
disabled = 0

[NAME 4]
connection = N3
data = non_audit
host = XXXXXX
index = checkpoint
interval = 60
mode = offline
noresolve = 1
starttime = 2018-02-28T20:00:00+05:00
disabled = 0

[QWE_Firewall_Audit]
connection = N
data = audit
host = XXXXX
index = checkpoint
interval = 3600
mode = offline
noresolve = 1

[XYZ_Firewall_Audit]
connection = N1
data = audit
host = XXXXX
index = checkpoint
interval = 3600
mode = offline
noresolve = 1
disabled = 0

[ABC_Firewall_Audit]
connection = N2
data = audit
host = XXXXXX
index = checkpoint
interval = 3600
mode = offline
noresolve = 0

[def_Firewall_Audit]
connection = N3
data = audit
host = XXXXXX
index = checkpoint
interval = 3600
mode = offline
noresolve = 1
disabled = 0

I have masked some values & change some names

0 Karma

tiagofbmm
Influencer

Any news on this issue? I have the same problem for a few connections

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!