Getting Data In

Force Re-Enumeration of all AD objects with ADmon?

Motivator

From my understanding, ADmon will pull down all objects in AD on first run, then only report changes from then on. However, the original baseline data will get lost when it ages out of an index.

Is there a way to force ADmon to re-enumerate all AD objects to get a proper baseline, occasionally?

1 Solution

Splunk Employee
Splunk Employee

You could do one of the following to re-sync the events from the server.

i) Manually add another stanza in etc\...\local\admon.conf like so:

[newCollection]
targetDc = "your Server here"
startingNode = 
monitorSubtree = 1
disabled = 0

ii) Use Splunkweb to add the new collection with the same settings as the old one.

iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon there is a file called "your collection name here.ini". Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate.

View solution in original post

Splunk Employee
Splunk Employee

You could do one of the following to re-sync the events from the server.

i) Manually add another stanza in etc\...\local\admon.conf like so:

[newCollection]
targetDc = "your Server here"
startingNode = 
monitorSubtree = 1
disabled = 0

ii) Use Splunkweb to add the new collection with the same settings as the old one.

iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon there is a file called "your collection name here.ini". Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate.

View solution in original post

Builder

Should it not be "inputs.conf" instead of "admon.conf"?

0 Karma

Splunk Employee
Splunk Employee

Yes

method 1 worked for me :
modify input app deployed on UF locally on AD :
in inputs.conf
change the admon collection name [admon:collection2]
used baseline=1
disabled=0
targetDC = "myAD"
index=myindex
monitorSubtree=1

push to uf
then wait for baseline to complete
then change baseline to 0 and repush to uf

This way is easier when you don't have local access on the AD to clean up files

0 Karma

Builder

Deleting the INI files is the way to go!

0 Karma

Motivator

I have not been able to test this, but am going to mark this as accepted. If anyone is able to test this, please comment!

0 Karma

Motivator

(Without completely clearing fishbucket.)

0 Karma