Getting Data In

How to monitor and alert on the status of services on a forwarder and when an External USB device is connected?

deepthi5
Path Finder

Hi,

I have 10 machines running a splunk forwarder now and I want to know the status of services on these machines.

For example, I have an Antivirus service running on ten machines. Whenever this service is stopped, I should get an alert, and when the service is started again, then I should get another alert.

Another example for the same 10 machines, if anyone connects an external USB device, I should get an alert and the details of this USB device connected, and another alert when it is disconnected.

Thanks and Regaards,
Deepthi

0 Karma

sandeepvalapi
New Member

Hi Deepthi,

I have to setup something similar like your requirement. I got to monitor all windows services and send out an alert. If you were successful in configuring USB device, can you please let me know the steps.

Thanks,
Sandeep

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi deepthi5,

This is more an OS then Splunk related question. You must first figure out how those 10 OS's report process status and USB connects. If you're using any unix/linux OS try the Splunk Unix App https://splunkbase.splunk.com/app/273/ and search your processes and USB events in index=os. Read more about the app here http://docs.splunk.com/Documentation/UnixApp/5.0.2/User/Whatdataarecollected

For Windows there is an app as well https://splunkbase.splunk.com/app/1680/ , but I'm not sure how or if your will be able to get the USB events (WMI maybe?)

Hope this helps to get you started ...

cheers, MuS

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...