Getting Data In

While setting up a Windows Eventlog collection input, why do I get an HTTP 500 - Access is denied error?

maverick
Splunk Employee
Splunk Employee

I want to gather and index the security eventtlogs on a remote Windows server.

While trying to add a new Windows Eventlog collection input within Splunk, I am getting the following error:

Failed to fetch data:[HTTP 500] Splunkd internal error;[{'text':"In handler 'win-wmi-enum-eventlogs': Error accessing MWI-0x7ff8fffb - Access is denied.. Make sure WMI is configured correctly.",'code':None, 'type': 'ERROR'}]

FYI, the user account that Splunk is running as also exists on the remote Windows machine and has full rights to administer both servers.

1 Solution

cervelli
Splunk Employee
Splunk Employee

The error is, alas, precise - we have attempted, and been explicitly denied, access to the logs.

This can happen for the following reasons :

  • you're not in a domain (see below)
  • Splunkd service is running with Local System permissions
  • Splunkd is running as a domain account, but cannot do at least one of these:
    • log on as a service on the remote box
    • bypass the firewall on the remote box, specifically IPSEC challenges
    • use Remote Launch and Remote Activation DCOM rights
    • Profile System Performance and Access this Computer from the Network GPO rights
  • The RPC service is running, but DCOM and/or WMI services are not

Whew. That's a lot of reasons, and there can be even more edge cases. For testing, try a domain admin account for the splunkd service login to verify connectivity is possible, then go from there to improve security. See:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWMIdata or http://msdn.microsoft.com/en-us/library/aa394603%28VS.85%29.aspx

RE: Domains. If you are NOT in a domain, it is possible to have identically named accounts with exactly the same login name and password who are both Local Administrators on both machines work with WMI. The polling Splunkd needs to have this account as it's service login.

Note this will NOT work if either machine is actually in a domain; both must be stand alone.

View solution in original post

jonm1010
New Member

Ok next question, does splunk need to be installed on each machine I want read the logs from?

0 Karma

cervelli
Splunk Employee
Splunk Employee

The error is, alas, precise - we have attempted, and been explicitly denied, access to the logs.

This can happen for the following reasons :

  • you're not in a domain (see below)
  • Splunkd service is running with Local System permissions
  • Splunkd is running as a domain account, but cannot do at least one of these:
    • log on as a service on the remote box
    • bypass the firewall on the remote box, specifically IPSEC challenges
    • use Remote Launch and Remote Activation DCOM rights
    • Profile System Performance and Access this Computer from the Network GPO rights
  • The RPC service is running, but DCOM and/or WMI services are not

Whew. That's a lot of reasons, and there can be even more edge cases. For testing, try a domain admin account for the splunkd service login to verify connectivity is possible, then go from there to improve security. See:

http://docs.splunk.com/Documentation/Splunk/5.0/Data/MonitorWMIdata or http://msdn.microsoft.com/en-us/library/aa394603%28VS.85%29.aspx

RE: Domains. If you are NOT in a domain, it is possible to have identically named accounts with exactly the same login name and password who are both Local Administrators on both machines work with WMI. The polling Splunkd needs to have this account as it's service login.

Note this will NOT work if either machine is actually in a domain; both must be stand alone.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...