snare running windows sending data to linux splunk server

New Member


I want to capture the windows event logs running on my windows servers from a linux server running linux.

Can it be done with snare?


Tags (1)
0 Karma


If your interested in the standard set of Event Logs/Active Directory/DNS/DHCP logs, then absolutely and it works well on everything up to and including Windows 2008R2. However, if you need to get any WMI data out of the servers, then consider using the splunk light weight forwarder and read the doc's on how to implement.

In my environment Windows Snare clients send tcp to a syslog-ng server on the same RHEL Linux box as Splunk resides. syslog-ng sends to Splunk and is the records manager for log retention. Snare client can be deployed via .exe or by .msi & group policy or via a third party tool like LANDesk. Need to make sure your Group Policy Auditing is tight and need to tweak the out of the box Snare objectives to get the detail you want. One advantage from my point of view is that logs from Snare are a single line syslog format and comingles well with CISCO data that I also retrieve/index.

New Member

I got it work with sname for the event logs.

How do I do dhcp or any other application logs

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!