Problems to collect data from Domain Controller (Active Directory)

[jcrival]

Hi Guys,

I have configured Splunk App for Windows Infraestructure on my Splunk Indexer. I also installed splunkforwarders on the remote servers and on the Domain Controller (Windows 2008 R2). I also copied the addons but i am not able to display the Domain Controller´s event logs (applications, system and security)

The splunkd.log I got this error

9-13-2014 18:14:19.519 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='File Replication Service'
09-13-2014 18:14:19.519 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - Processing: 'blacklist1', failed to find delimeter '4' in regex '4662 Message="Object Type:\s+(?!groupPolicyContainer)"' for key 'EventCode '. Discarding.
09-13-2014 18:14:19.519 -0500 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - Processing: 'blacklist2', failed to find delimeter '5' in regex '566 Message="Object Type:\s+(?!groupPolicyContainer)"' for key 'EventCode '. Discarding.

Could you please help me out with the correct configuration

Regards,

Jose C. Rivera

[michaelstillmun]

When you see an WinEventMon:: error stating it is unable to find the Log with channel name="foo" often means the the Event Log Name is named differently then what is configured in your forwarder's inputs.conf stanza.

Also the "File Replication Service" is considered a non-default Windows event log. You must import them to the Windows Event Viewer.

After you import the log, you can add them to your forwarder's local copy of inputs.conf, as follows:

[WinEventLog://File Replication Service]
disabled = 0

This may fix both problems, if not double-check your Regex statement for accuracy.

A issue I had was I needed to monitor workstation cdrom usage. For my forwarder's inputs.conf is was using the following stanza:

[WinEventLog://Microsoft-Windows-CDROM]
disabled = 0

But if you take a look at the logs using poweshell: Get-WinEvent -ListProvider cdrom you see:

PS C:\> Get-WinEvent -ListProvider cdrom

Name     : cdrom
LogLinks : {System}
Opcodes  : {}
Tasks    : {}

Name     : Microsoft-Windows-CDROM
LogLinks : {Microsoft-Windows-CDROM/Operational}
Opcodes  : {win:Info}
Tasks    : {CDROM_DRIVER}

Looking at the LogLinks, I see I needed to use the System log and proper event codes. Changed my stanza to reflect looking at the system log and to blacklist all but the code i wanted:

[WinEventLog://System]
disabled=0
blacklist1= 0-112,114-99999

Regards,
Michael Stillmunks

[jcrival]

Hi Mario
Here the versions:

• Splunk forwarder on Domain Controller: splunkforwarder-6.1.3-220630-x64-release.msi
• Splunk Indexer (Windows 7): Splunk 6.1.2 (build 213098)
• Splunk App for Windows Infrastructure: splunk-app-for-windows-infrastructure_103
• Splunk addon for microsoft: splunk-add-on-for-microsoft-windows_471

Regards,

Jose Carlos

[MarioM]

Can you give the versions of : Splunk App for Windows Infraestructure,Splunk Indexer,splunkforwarders?

[michaelstillmun]

Jose,

When you see an WinEventMon:: error stating it is unable to find the Log with channel name="foo" often means the the Event Log Name is named differently then what is configured in your forwarder's inputs.conf stanza.

Also the "File Replication Service" is considered a non-default Windows event log. You must import them to the Windows Event Viewer.

After you import the log, you can add them to your forwarder's local copy of inputs.conf, as follows:

[WinEventLog://File Replication Service]
disabled = 0

Regards,
Michael Stillmunks