Getting Data In

Props.conf for ClamAV scan log

jkamdar
Path Finder

I have ClamAV running on all my linux hosts (universal forwarders) and all logsseems to be fine except clamav logs. ClamAV scan report has unusual log format (see below). I need help with how to ingest that report. Splunk (splunkd.log) shows error when I try to ingest it. I think, I need to setup a props.conf but I am not sure, how to go about doing it. This is an air gapped system, just FYI. 

splunkd.log

ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=/var/log/audit/clamav_scan_20240916_111846.log). Last time we saw this, filename was different. You may wish to use larger initCrcLen for this sourcetype or a CRC salt on this source.

Clamav scan generates log file as shown below:

-----------SCAN SUMMARY--------------
Known Viruses: xxxxxx
Engine Version: x.xx.x
Scanned Directories: xxx
Scanned Files: xxxxx
Infected Files: x
Data Scanned: xxxxMB
Data Read: xxxxMB
Time:
Start Date: 2024:09:16 14:46:58
End Date: 2024:09:16 16:33:06

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's understandable. Your files consist mostly of a relatively constant part repeated across all files (the header and some relatively constant fields) so Splunk will be guessing that it's all the same file.

If the filenames are unique and the files are not rotated in any way, you can use

crcSalt=<SOURCE>

(That's actually one of the rare cases it can actually make sense).

Otherwise, raise initCrcLength so that it catches variable parts of the event.

As a side note, it seems that the event is very verbose and could use some serious editing on ingest to save on license (you don't need majority of the raw data). Additional questin is whether there should be any event breaking done within a single fioe.

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...