Editing Splunk Logs

[ceichhorn]

I'm testing whether event logs in Splunk can be edited and, if so, if those changes are themselves logged. For instance, if Splunk service is turned off, can the logs be edited? And if so, when Splunk turns back on, does it alert in any way that the logs have been changed? Thanks in advance for any information.

[MuS · Accepted solution]

Hi ceichhorn,

Splunk does not check if its own logs have been edited somehow.

But, you can enable file auditing in your OS and index the results of the audit on the Splunk logs like splunkd.log or audit.log. Based on that you can also setup some alerts in Splunk, so you will get notified if there was some edits on the Splunk logs.

See some examples on how to enable auditing for Linux or Windows. Linux auditing messages can get by scripted input into Splunk and Windows auditing messages will by in the Windows Security Events.

hope this helps ...

cheers, MuS

[lguinn2]

What do you mean by "event logs in Splunk?"

Do you mean the Splunk logs like splunkd.log or other logs like the Windows Event logs?