Deployment Architecture

Splunk query to see Linux patching

Prakash493
Communicator

Hi , Our most of the splunk servers are Linux based systems , How can i create a splunk query to verify if Linux OS patch has been successful or not ?

0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hello. I would install the Linux add on to collect data about your operating system.

https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About

There's version.sh which would collect the data.

Then I would figure out what the current version is on your situation and alert on hosts that need patching.

View solution in original post

0 Karma

st14014
New Member

Depends on your distribution toolset (yum, zypper, apt, ...)

Write a script to integrate patches etc. into your system. The Script should be able to analyse the installation and generate useful logdata four your syslog (local or remote).
The TA for unix has an update-script, which is only useful for redhat or darwin based systems. For "linux", aka redhat-based distros, the output of yum check-update is parsed via awk. So you have to use a tool for integrating the patches.

0 Karma

Prakash493
Communicator

i am not aware of any script i got the file name on the add-on what needs to be turned on.

0 Karma

burwell
SplunkTrust
SplunkTrust

Hello. I would install the Linux add on to collect data about your operating system.

https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About

There's version.sh which would collect the data.

Then I would figure out what the current version is on your situation and alert on hosts that need patching.

0 Karma

Prakash493
Communicator

Thank you so much for the update yes we do have that add-on and version.sh file is disabled , i will turn the logging for it.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...