Getting Data In

How to collect FTP and SFTP activity on servers via Splunk?

eboyd
New Member

We would like to gather information on inbound and outbound ftp and secure ftp connections made to our servers from within our intranet. The message should be logged on the server logs. I need to know how I can query Splunk to pickup this information.

Note: This is not related to sending the log files into Splunk using FTP. All searches I have done thus far are just related to the topic of moving log files to Splunk using ftp.

0 Karma

myriadic
Path Finder

If the logs are on the ftp server, can you just install the universal forwarder to send them to splunk?

0 Karma

woodcock
Esteemed Legend

Your most flexible option is to use stream:

https://splunkbase.splunk.com/app/1809/

0 Karma