Getting Data In

How to collect "Analytic and Debug logs" from Windows Event Log?

las
Contributor

Hi.

I am trying to get Splunk to read an "AD FS 2.0 Tracing/debug" log.
When looking at the log in the Windows eventViewer, you have to enable the viewing by right clicking on "Applications and Services logs" select View and enable "Show Analytic and Debug logs".

When looking at the eventlog properties, they show the name as "AD FS 2.0 Tracing/Debug"

I paste that name into the inputs.conf, restart the Universal forwarder, and expects the logs to show up in my Splunk instance, sadly no logs show up.
I have verified there are log entries when looking thru Winevent viewer.
I get both the security log and an Admin log from the same server.

Do I have to do something different when dealing with debug logs?

My inputs.conf file for the server:

[default]
evt_dc_name =
evt_dns_name =

[WinEventLog://AD FS 2.0/Admin]
index = wineventlog
disabled = 0

[WinEventLog://Security]
index = wineventlog
disabled = 0

[WinEventLog://AD FS 2.0 Tracing/Debug]
index = wineventlog
disabled = 0

[WinEventLog://AD FS 2.0 Tracing-Debug]
index = wineventlog
disabled = 0

Thanks for the help.

0 Karma
1 Solution

wbfoxii
Communicator

OK - My ADFS team enabled this and they are dumping to a text file. I'm picking them up with this stanza:

[monitor://C:\Windows\System32\winevt\Logs\AD FS Tracing.evtx]

I did not have to specify a sourcetype and this is what showed up:
sourcetype="WinEventLog:AD FS Tracing/Debug"

Our admins are not enabling Debug all of the time, because (as you expect, it sure generates events!)

View solution in original post

0 Karma

wbfoxii
Communicator

OK - My ADFS team enabled this and they are dumping to a text file. I'm picking them up with this stanza:

[monitor://C:\Windows\System32\winevt\Logs\AD FS Tracing.evtx]

I did not have to specify a sourcetype and this is what showed up:
sourcetype="WinEventLog:AD FS Tracing/Debug"

Our admins are not enabling Debug all of the time, because (as you expect, it sure generates events!)

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi las,
you have to understand where your application puts its logs: in WinEventLog:Security or WinEventLog:Application?
after you have to enable the relative monitoring

[WinEventLog://Application]
disabled = 0
current_only = 0
checkpointInterval = 5
index = wineventlog

or

[WinEventLog://Security]
disabled = 0
current_only = 0
evt_resolve_ad_obj = 1
checkpointInterval = 5
index = wineventlog
ignoreOlderThan = 2d

Bye.
Giuseppe

0 Karma

las
Contributor

Hi Giuseppe.

The log is neither in the application, security or system logs.
When I look at the properties for ADFS 2.0 admin log it shows this:
Full Name: AD FS 2.0/Admin
This log is correctly indexed by Splunk

When I look at the debug log it show the following:
Full Name: AD FS 2.0 Tracing/Debug
This one is not indexed.

Kind regards
Lars

0 Karma

gcusello
SplunkTrust
SplunkTrust

are there AD FS 2.0 Tracing/Debug in WinEventViewer?
Maybe Debug logging must be enabled by the application.
Bye.
Giuseppe

0 Karma

las
Contributor

I think this is the same problem as stcrispan has a question on here
https://answers.splunk.com/answers/443320/how-to-collect-windows-event-logs-that-are-not-fro.html

Kind regards
Lars

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...