Deployment Architecture

Splunk query to see Linux patching

Prakash493
Communicator

Hi , Our most of the splunk servers are Linux based systems , How can i create a splunk query to verify if Linux OS patch has been successful or not ?

0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

Hello. I would install the Linux add on to collect data about your operating system.

https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About

There's version.sh which would collect the data.

Then I would figure out what the current version is on your situation and alert on hosts that need patching.

View solution in original post

0 Karma

st14014
New Member

Depends on your distribution toolset (yum, zypper, apt, ...)

Write a script to integrate patches etc. into your system. The Script should be able to analyse the installation and generate useful logdata four your syslog (local or remote).
The TA for unix has an update-script, which is only useful for redhat or darwin based systems. For "linux", aka redhat-based distros, the output of yum check-update is parsed via awk. So you have to use a tool for integrating the patches.

0 Karma

Prakash493
Communicator

i am not aware of any script i got the file name on the add-on what needs to be turned on.

0 Karma

burwell
SplunkTrust
SplunkTrust

Hello. I would install the Linux add on to collect data about your operating system.

https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About

There's version.sh which would collect the data.

Then I would figure out what the current version is on your situation and alert on hosts that need patching.

View solution in original post

0 Karma

Prakash493
Communicator

Thank you so much for the update yes we do have that add-on and version.sh file is disabled , i will turn the logging for it.

0 Karma