Getting Data In

Options on installing universal forwarders on "Windows Machines"

ranjitbrhm1
Communicator

Hello All, Im a bit confused with the installation of a UF on the windows machine. According to the documents, there are 2 methods to install splunk UF. One with the local account and one with the domain account. Now, My question is lets say im setting it up on a "web server" , Should i select local account or domain account to pull the web server logs, in this case the iis logs. Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password? Is it like i have a server and there are multiple people logging on to that "specific server" also if i install it as a domain user, will it not collect the system logs by default? Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?

0 Karma
1 Solution

FrankVl
Ultra Champion

Let's go one by one:
Q: Should i select local account or domain account to pull the web server logs, in this case the iis logs.?
A: That does not so much depend on which logs you want to collect. It is more of a security decision to be made. Installing splunk to run under local system account is simple at install time and will usually mean you won't have to do much work to get it access to all kinds of logs on the machine. Using a domain account will allow you to run splunk with less privileges (so reducing some risks of a vulnerability in Splunk being abused to gain admin access on that machine), but is a bit more hassle to set up and manage.

Q: Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password?
A: Where exactly did you get this from? I don't think I completely understand this question.

Q: also if i install it as a domain user, will it not collect the system logs by default?
A: a normal, unprivileged domain user may not have access to the windows event logs by default, this is some of the extra effort you need to put in when using a domain account.

Q: Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?
A: No, it does not. While it is possible to remotely monitor windows hosts using WMI, this is typically not recommended and requires the use of a Heavy Forwarder, not a UF: http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindows...

View solution in original post

0 Karma

FrankVl
Ultra Champion

Let's go one by one:
Q: Should i select local account or domain account to pull the web server logs, in this case the iis logs.?
A: That does not so much depend on which logs you want to collect. It is more of a security decision to be made. Installing splunk to run under local system account is simple at install time and will usually mean you won't have to do much work to get it access to all kinds of logs on the machine. Using a domain account will allow you to run splunk with less privileges (so reducing some risks of a vulnerability in Splunk being abused to gain admin access on that machine), but is a bit more hassle to set up and manage.

Q: Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password?
A: Where exactly did you get this from? I don't think I completely understand this question.

Q: also if i install it as a domain user, will it not collect the system logs by default?
A: a normal, unprivileged domain user may not have access to the windows event logs by default, this is some of the extra effort you need to put in when using a domain account.

Q: Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?
A: No, it does not. While it is possible to remotely monitor windows hosts using WMI, this is typically not recommended and requires the use of a Heavy Forwarder, not a UF: http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindows...

0 Karma

ranjitbrhm1
Communicator

Think i read something else. I understand now. Thanks.

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...