Getting Data In

Props.conf for ClamAV scan log

jkamdar
Path Finder

I have ClamAV running on all my linux hosts (universal forwarders) and all logsseems to be fine except clamav logs. ClamAV scan report has unusual log format (see below). I need help with how to ingest that report. Splunk (splunkd.log) shows error when I try to ingest it. I think, I need to setup a props.conf but I am not sure, how to go about doing it. This is an air gapped system, just FYI. 

splunkd.log

ERROR TailReader - File will not be read, is too small to match seekptr checksum (file=/var/log/audit/clamav_scan_20240916_111846.log). Last time we saw this, filename was different. You may wish to use larger initCrcLen for this sourcetype or a CRC salt on this source.

Clamav scan generates log file as shown below:

-----------SCAN SUMMARY--------------
Known Viruses: xxxxxx
Engine Version: x.xx.x
Scanned Directories: xxx
Scanned Files: xxxxx
Infected Files: x
Data Scanned: xxxxMB
Data Read: xxxxMB
Time:
Start Date: 2024:09:16 14:46:58
End Date: 2024:09:16 16:33:06

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's understandable. Your files consist mostly of a relatively constant part repeated across all files (the header and some relatively constant fields) so Splunk will be guessing that it's all the same file.

If the filenames are unique and the files are not rotated in any way, you can use

crcSalt=<SOURCE>

(That's actually one of the rare cases it can actually make sense).

Otherwise, raise initCrcLength so that it catches variable parts of the event.

As a side note, it seems that the event is very verbose and could use some serious editing on ingest to save on license (you don't need majority of the raw data). Additional questin is whether there should be any event breaking done within a single fioe.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...