Getting Data In

RedHat Linux rsyslog logging command execution

jackbenimble
New Member

Has anyone been successful logging command execution events on RedHat and having them be sent to Splunk via rsyslog?

The logs get written to tty but they are not making its way to our HF. We can easily log all of auditd and system events but nothing for command execution. 

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

These are two separate problems.

One is auditing commands in your local system (which can be done using several methods, each with their pros and cons; the typical method is auditd).

Another one is sending the data out from your box to Splunk.

If you want to use auditd, you need to create auditd rules to track spawning new processes. This is out of scope of this forum and there are many documents all around the internet how to do that depending on what data you want logged and in which situations (logging every single process creation might be an overkill).

Typically you write auditd logs to /var/log/audit/audit.log so you need to set up your rsyslog to read that file (you need to define an input with imfile type.

And to send the files to the HF you can either use simple tcp or udp output and have a corresponding input defined on your HF (but it's not a recommended way) or you can create a HEC input on your HF and send to it via an omhttp output in your rsyslog (provided you have a sufficiently new version - not all distro-shipped versions contain that input; especially older ones). If you want to be selective, you might tie a ruleset containing that HF output to that audit.log file input.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...