Why am I unable to send audit logs from Linux to Splunk via rsyslog?

[rb51]

hi all,

I need to send audit logs from RedHat 5.8 to my Splunk Indexer - both machines on the same network.

On RHEL 5.8, I installed rsyslog and configure the following:

rsyslog.conf file
$UDPServerRun 9514
audit.log @< Indexer-IP>:9514

Restarted rsyslog service and confi'ed to survive reboots

I can see the file audit.log is being appended by tailing it.

On Splunk Indexer, I created a new UDP Input.
UDP:9514
SourceType: I tried linux_audit, Linux_messages_syslog,linux_secure

But the Indexer is not receiving the audit.log data from the RHEL system.

What am I missing?

[lguinn2]

I suggest that you install the Splunk Universal Forwarder on the RedHat 5.8 box. Simply configure the forwarder to monitor the audit logs and output to the Splunk indexers. This will use TCP for transport and be more resilient than rsyslog over UDP.

For the most trivial installation possible:
- Configure your Splunk indexer to listen for forwarded data on a "receiving port." (For this example: 9997)
- Pick or create a non-privileged user to run Splunk on the RedHat box. (how about splunkIT for this example)
- Download the Splunk Universal Forwarder to the RedHat box and install. (Install anywhere, but assume /opt/splunk for this example)
- Execute the following commands

cd /opt/splunk/bin
./splunk start --accept-license
sudo ./splunk enable boot-start -user splunkIT
./splunk add forward-server yourIndexer:9997
./splunk add monitor /var/log/audit/

Of course, there are many more ways to configure this, but this is simple and will survive reboots. It will also restart wherever it left off in the audit logs, should Splunk be stopped/restarted. It is intelligent about rolling log files.

[rb51]

managed to get this working by editing the audit.rules file, but using

. @:port rather than only audit.log file