populate posix_identities from several hosts

[auradk]

I can not get my head around this. I can see in the documentation that i should install and run the user commands on the search head.

I have a hosting environment with several ldap directories (active directory) and different user setups on each host.
Should i install the TA on each host to populate the posix_identities? I just can not see how the host and uid is resolved to a posix name on each server when the extraction is only installed on the splunk servers.

Please enlighten me.

[doksu · Accepted solution]

There's a few questions there so I'll answer them one by one:

• Yes, the TA must be installed and lookups populated on all search heads you wish to use with the Linux Auditd app

• If I understand correctly, you don't have shell access to the search head and so can't run the awk command to populate the local posix user lookup? Don't worry too much if you can't for one reason or another populate the local and directory lookups, because version 2 of the app automatically learns your users. 🙂 I will update the documentation to clarify this point.

• If you have multiple directories, you need to populate the directory posix user lookup with your posix users across them all. There are many ways to approach this but it depends entirely on your environment so I can't really comment on the specifics.

• It sounds like uids are not consistent across your environment? This is undesirable to say the least and will likely cause issues for many reasons, not only the Linux Auditd app. Having said that, if the Linux Auditd app detects a uid conflict, it will resolve it by populating the user field with the uid. If you haven't already watched this video I'd recommend having a look: https://www.youtube.com/watch?v=M7QZRAHSs5E