Monitoring Registry via universal forwarder not working

[evo1988]

Hi,

I am trying to monitor a registry key from a remote server using a universal forwarder. No matter what i put in my inputs.conf, i just cannot get it to work. This is my inputs.conf:

[WinRegMon://Registry]
disabled = 0
hive = HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\SOPHOS\AUTOUPDATE\UPDATESTATUS\.*
proc = .*
type = set

I can see the following error in my splunkd.log:

message from ""Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe" --driver-path "Program Files\SplunkUniversalForwarder\bin"" splunk-regmon - No enabled entries have been found for regmon or procmon in the conf file.

I must be missing something simple! Please help!

Many thanks,

Michael

[Richfez]

From inputs.conf:
If you configure the inputs with Splunk Web, the value of "" matches
what was specified there. While you can add event log monitor inputs
manually, it is best practice to use Splunk Web to configure
Windows registry monitor inputs because it is easy to mistype the values
for Registry hives and keys.

Have you tried installing Splunk on a box that has sophos installed, and drilling down into that particular registry key as an input and then seeing what it wrote for the actual stanza?

Here's what I get using some other random key... maybe it'll help you spot anything wrong with your own.

[WinRegMon://MyTest]
baseline = 0
disabled = 0
hive = HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Mozilla\\NativeMessagingHosts\\com.webex.meeting
index = bugger_all
proc = C:\\.*
type = set

Also please use the code button to paste code so that the special characters don't get eaten by the editor.

Lastly, I'd not name the stanza "registry". If you want another key later, ... well, then you either have two stanzas named "registry" and "registry2" (lol) or you'll have one named "registry" and another "typicalSpywareKeys", which ... the "registry" one seems a bit out of place then. 🙂