Deployment Architecture

Why am I unable to send audit logs from Linux to Splunk via rsyslog?


hi all,

I need to send audit logs from RedHat 5.8 to my Splunk Indexer - both machines on the same network.

On RHEL 5.8, I installed rsyslog and configure the following:

rsyslog.conf file
$UDPServerRun 9514
audit.log @< Indexer-IP>:9514

Restarted rsyslog service and confi'ed to survive reboots

I can see the file audit.log is being appended by tailing it.

On Splunk Indexer, I created a new UDP Input.
SourceType: I tried linux_audit, Linux_messages_syslog,linux_secure

But the Indexer is not receiving the audit.log data from the RHEL system.

What am I missing?

0 Karma


I suggest that you install the Splunk Universal Forwarder on the RedHat 5.8 box. Simply configure the forwarder to monitor the audit logs and output to the Splunk indexers. This will use TCP for transport and be more resilient than rsyslog over UDP.

For the most trivial installation possible:
- Configure your Splunk indexer to listen for forwarded data on a "receiving port." (For this example: 9997)
- Pick or create a non-privileged user to run Splunk on the RedHat box. (how about splunkIT for this example)
- Download the Splunk Universal Forwarder to the RedHat box and install. (Install anywhere, but assume /opt/splunk for this example)
- Execute the following commands

cd /opt/splunk/bin
./splunk start --accept-license
sudo ./splunk enable boot-start -user splunkIT
./splunk add forward-server yourIndexer:9997
./splunk add monitor /var/log/audit/

Of course, there are many more ways to configure this, but this is simple and will survive reboots. It will also restart wherever it left off in the audit logs, should Splunk be stopped/restarted. It is intelligent about rolling log files.


managed to get this working by editing the audit.rules file, but using

. @:port rather than only audit.log file

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...