Getting Data In

Source type for dmesg log file

scottj1y
Path Finder

I was wondering if anyone had a good solution for a proper source type for dmesg? Or failing that some way of handling the fact it is different than most other logs in that entries aren't always single lines, and the timestamps are relative to system boot. That makes it difficult for the indexers to assign a time stamp for the entries.

0 Karma

scottj1y
Path Finder

A Forwarder can't read dmesg command outputs. It will be directly monitoring /var/log/dmesg which doesn't contain time stamps.

0 Karma

PavelP
Motivator

That's true!
If the UF runs as root you can get continuous dmesg output using scripting input.

I hope somebody can provide a solution to calculate a correct timestamp (if it is relevant).

0 Karma

PavelP
Motivator

Hello @scottj1y ,

  • entries aren't always single lines - no problem with splunk, just set properly SHOULD_LINEMERGE=false and LINE_BREAKER/TIME_FORMAT
  • the timestamps are relative to system boot - use one of following to get human readable timestamp:

T + x switches:

switch -x  - Decode facility and level (priority) number to human readable prefixes.
switch -T - Print human readable timestamps.  The timestamp could be inaccurate!
[root@linux ~]# dmesg -x -T|head
kern  :notice: [Fri Mar 27 14:42:48 2020] Linux version 4.19.94-2.xxxx 
kern  :info  : [Fri Mar 27 14:42:48 2020] Command line: BOOT_IMAGE=/boot/vmlinuz-4.19.94-2.xxxxx
kern  :info  : [Fri Mar 27 14:42:48 2020] KERNEL supported cpus:
kern  :info  : [Fri Mar 27 14:42:48 2020]   Intel GenuineIntel
kern  :info  : [Fri Mar 27 14:42:48 2020]   AMD AuthenticAMD
kern  :info  : [Fri Mar 27 14:42:48 2020]   Centaur CentaurHauls
kern  :info  : [Fri Mar 27 14:42:48 2020] Disabled fast string operations
kern  :info  : [Fri Mar 27 14:42:48 2020] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'

with -T only:

[root@mwg42 ~]# dmesg -T|head
[Fri Mar 27 14:42:49 2020] Linux version 4.19.94-2.xxxx
[Fri Mar 27 14:42:49 2020] Command line: BOOT_IMAGE=xxxx 
[Fri Mar 27 14:42:49 2020] KERNEL supported cpus:
[Fri Mar 27 14:42:49 2020]   Intel GenuineIntel
[Fri Mar 27 14:42:49 2020]   AMD AuthenticAMD
[Fri Mar 27 14:42:49 2020]   Centaur CentaurHauls
[Fri Mar 27 14:42:49 2020] Disabled fast string operations
[Fri Mar 27 14:42:49 2020] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'

indeed, the dmesg can contain a lot of different log formats, it is difficult to pick one right sourcetype. What about "dmesg"?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Is this for manually executed dmesg commands? If so, then you can just default to "now" as the event _time, and it would be fine.

0 Karma

scottj1y
Path Finder

No, this is for continuous monitoring like any other log file.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...