WinEventMon::processLogChannel unable to checkpoint

[danilom]

Hello,
I have all my Splunk Universal Forwarders on Windows 2008 R2 machines that are generating this error:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::processLogChannel: Failed to checkpoint for channel='security'

The only modification that I have made is to the inputs.conf file adding:

[WinEventLog://Security]
disabled = 0
whitelist = 4624,4625,4634,4656,4659,4660

Any suggestion?

Regards
Danilo Massa

[rbal_splunk]

Filtering of Windows Event using whitelist = << list >> or blacklist = << list >>, does work on Universal Forwarder in 6.x. Also, in my environment using stanza like below does not cause the warning.

...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf [WinEventLog://Security]
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf blacklist = 5156
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf checkpointInterval = 5
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf current_only = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf disabled = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dc_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dns_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_resolve_ad_obj = 1
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf start_from = oldest

[andreasz]

"...seems that filtering in not supported on Universal Forwarder"

It's only supported for Windows EventLogs as described in the input.conf documentation:
Filtering in input.conf on the indexer wouldn't make any sense. You could only filter the Windows EventLogs on the indexer. It works for UF.

# Windows Event Log Monitor

blacklist = << list >>

• Tells Splunk which event IDs and/or event ID ranges that incoming events must NOT have in order to be indexed.
• Optional. This parameter can be left empty.
• A comma separated list of event ID and event ID ranges to exclude (example: 4,5,7,100-200).
• If no value is present, then there is no effect.
• If you specify both the "whitelist" and "blacklist" attributes, the input ignores the "blacklist" attribute.

whitelist = << list >>

• Tells Splunk which event IDs and/or event ID ranges that incoming events must have in order to be indexed.
• Optional. This parameter can be left empty.
• A comma-separated list of event ID and event ID ranges to include (example: 4,5,7,100-200).
• If no value is present, defaults to include all event IDs.
• If you specify both the "whitelist" and "blacklist" attributes, the input ignores the "blacklist" attribute.

[danilom]

From http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Typesofforwarders#Forwarder_comparison seems that filtering in not supported on Universal Forwarder ...

[andreasz]

"...I have found that changing inputs.conf on a Universal Forwarder is not an option on Splunk 6.0.2."

Is this a known bug?
According to the documentation it's still valid

http://docs.splunk.com/Documentation/Splunk/6.0.2/admin/inputsconf

And here is a blog from Adrian Hall

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

"I included two techniques – firstly, filtering by event code so that you didn’t include the events you didn’t want; and secondly, filtering the explanatory text on the end of each event."
"Let’s say you don’t want firewall events. From the previous blog post, event ID 5156 and 5157 detail the firewall connection accept and deny messages. Let’s say those are not relevant to us. Previously, we had to add a props.conf stanza to initiate a filtering action that was done in transforms.conf – it was complicated. In Splunk 6, everything is done in inputs.conf."

[danilom]

Sorry ... my fault I have found that changing inputs.conf on a Universal Forwarder is not an option on Splunk 6.0.2.
So I have put this filter on the props/transforms on the index server.

Regards
Danilo

[andreasz]

Hello,

same here.

I'm using the blacklist option instead.

Regards

Andreas