Getting Data In

Options on installing universal forwarders on "Windows Machines"

ranjitbrhm1
Communicator

Hello All, Im a bit confused with the installation of a UF on the windows machine. According to the documents, there are 2 methods to install splunk UF. One with the local account and one with the domain account. Now, My question is lets say im setting it up on a "web server" , Should i select local account or domain account to pull the web server logs, in this case the iis logs. Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password? Is it like i have a server and there are multiple people logging on to that "specific server" also if i install it as a domain user, will it not collect the system logs by default? Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?

0 Karma
1 Solution

FrankVl
Ultra Champion

Let's go one by one:
Q: Should i select local account or domain account to pull the web server logs, in this case the iis logs.?
A: That does not so much depend on which logs you want to collect. It is more of a security decision to be made. Installing splunk to run under local system account is simple at install time and will usually mean you won't have to do much work to get it access to all kinds of logs on the machine. Using a domain account will allow you to run splunk with less privileges (so reducing some risks of a vulnerability in Splunk being abused to gain admin access on that machine), but is a bit more hassle to set up and manage.

Q: Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password?
A: Where exactly did you get this from? I don't think I completely understand this question.

Q: also if i install it as a domain user, will it not collect the system logs by default?
A: a normal, unprivileged domain user may not have access to the windows event logs by default, this is some of the extra effort you need to put in when using a domain account.

Q: Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?
A: No, it does not. While it is possible to remotely monitor windows hosts using WMI, this is typically not recommended and requires the use of a Heavy Forwarder, not a UF: http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindows...

View solution in original post

0 Karma

FrankVl
Ultra Champion

Let's go one by one:
Q: Should i select local account or domain account to pull the web server logs, in this case the iis logs.?
A: That does not so much depend on which logs you want to collect. It is more of a security decision to be made. Installing splunk to run under local system account is simple at install time and will usually mean you won't have to do much work to get it access to all kinds of logs on the machine. Using a domain account will allow you to run splunk with less privileges (so reducing some risks of a vulnerability in Splunk being abused to gain admin access on that machine), but is a bit more hassle to set up and manage.

Q: Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password?
A: Where exactly did you get this from? I don't think I completely understand this question.

Q: also if i install it as a domain user, will it not collect the system logs by default?
A: a normal, unprivileged domain user may not have access to the windows event logs by default, this is some of the extra effort you need to put in when using a domain account.

Q: Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?
A: No, it does not. While it is possible to remotely monitor windows hosts using WMI, this is typically not recommended and requires the use of a Heavy Forwarder, not a UF: http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindows...

0 Karma

ranjitbrhm1
Communicator

Think i read something else. I understand now. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...