Getting Data In

How to prevent internal Splunk audit logs from being written to /var/log/audit?

jravida
Communicator

Hi folks,

So I am running a distributed deployment. It seems that, on my index server (running RedHat), SPlunk is sending loads of internal audit events to /var/log/audit/audit.log. I am not indexing this nor do I care about the large volumes of information Splunk is logging here. It ends up filling 50MB of space per hour.

Is there a mechanism to prevent all these logs from writing to the audit log on my server?

Tags (3)

mad4wknds
Path Finder

I know that this is a very old post but I think this is the answer. Change the audit rules for auditing splunk directories
echo "# Exclude Splunk directories" >> /etc/audit/audit.rules
echo "-W never,exit -F path=/app/splunk/ -k exclude" >> /etc/audit/audit.rules
echo "-W never,exit -F path=/data1/splunk/ -k exclude" >> /etc/audit/audit.rules
echo "-W never,exit -F path=/data2/splunk/ -k exclude" >> /etc/audit/audit.rules

ppablo
Retired

Hi @jravida

If you want to prevent certain logs from being indexed in Splunk, you can configure inputs.conf with blacklist rules. Check out the following documentation on whitelist and blacklist monitoring. http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Whitelistorblacklistspecificincomingdata

0 Karma

ppablo
Retired

Ah sorry @jravida I didn't catch that part.

0 Karma

jravida
Communicator

The logs aren't being index from what I can tell. They are just getting saved to the filesystem.

0 Karma

yannK
Splunk Employee
Splunk Employee

Yes the log rotation defined in $SPLUNK_HOME/etc/log.cfg

Splunk will maintain 5 rotated copies of 25MB each of the audit.log, so the maximum will be 125MB.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...