Deployment Architecture

How to have linux box forward start up and user information to splunk?

zblum
Engager

I am trying to set up my linux VM to forward all vm starts/stops/restarts along with user login logs to a splunk web server for monitoring. The spunk instance is hosted on the VM. How would I set up a log forwarder to go between the two of them, so I can see all major actions happening on the VM inside Splunk? Thanks.

0 Karma

solarboyz1
Builder

To clarify, you are talking about collecting the system and authentication log from a linux VM.
You can do this in a couple ways.

Here's how a method that should be easy:

  1. On the linux VM, configure rsyslog or syslog-ng to write the events you are interested in to a log file
    By default, these events might already be going to /var/log/secure (authentication) and /var/log/messages (system).

  2. Install Splunk UF on the VM, and configure inputs to monitor the logs you configured. Set sourcetype to syslog

  3. Configure UF to send events to your Splunk instance.

If you also want to get information from the VMware level, you will need to install the Splunk app for VMware. That app takes some setup to integrate with your VMware architecture.

0 Karma

zblum
Engager

Correct. I am trying to collect the system and auth log from a linux VM (Hosted on Hyper-V server), and push them for monitoring to Splunk.

0 Karma

FrankVl
Ultra Champion

If the splunk instance you're trying to send to is on that same VM (as I understand from your question), you can skip the UF install and just configure the inputs directly on the existing splunk instance. Make sure to also install the Splunk Add-On for Unix and Linux (https://splunkbase.splunk.com/app/833/) to get field extractions etc.

0 Karma

solarboyz1
Builder

Then the steps above should work.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...