Getting Data In

Why are my Windows Event Logs not being forwarded properly with an intermediate forwarder?

cchitten
Path Finder

I am using an intermediary server (server 2) to collect forwarded logs from many servers (server 3,4,5,etc) and then I use a Splunk forwarder on there to forward those events to my full splunk instance server (server 1).

However, my events are not being forwarded properly. On server 2 they look like this:

   [ Name]  Microsoft-Windows-Security-Auditing 
   [ Guid]  {*****************} 
   EventID 4769 
   Version 0 
   Level 0 
   Task 14337 
   Opcode 0 
   Keywords 0x6020000000000000 
  - TimeCreated
   [ SystemTime]  2015-02-23T14:17:22.10657400Z 
   EventRecordID 705673 
   Correlation 
  - Execution
   [ ProcessID]  568 
   [ ThreadID]  5524 
   Channel Security 
   Computer ****************
   Security 

  TargetUserName *********
  TargetDomainName ************
  ServiceName *********
  ServiceSid *********
  TicketOptions 0x40810345
  TicketEncryptionType 0x13
  IpAddress ***********
  IpPort ******** 
  Status 0x0 
  LogonGuid {************} 
  TransmittedServices - 

   [ Culture]  en-US 
   Message [*long message here*]
   Task Kerberos Service Ticket Operations 
   Opcode Info 
   Channel Security 
   Provider Microsoft Windows security auditing. 

   Keyword Audit Success 

But in splunk it just appears as this:

02/23/2015 02:08:40 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4769
EventType=0
Type=Microsoft Windows security auditing.
ComputerName=************
TaskCategory=Microsoft Windows security auditing.
OpCode=Microsoft Windows security auditing.
RecordNumber=705673
Keywords=Microsoft Windows security auditing.
Message=Microsoft Windows security auditing.

What could be happening in between that is affecting my event details?

0 Karma

lmyrefelt
Builder

I have had the setup " a long time ago" .. and it work without this kind of problems at least ... have you done some changes on the windows collector side as how to process or maybe write/ save the events down on disk again ?Xml versus text or something ..

0 Karma

cchitten
Path Finder

No. Just simply installed the splunk_TA_windows app onto my forwarder and that is what i got through.

0 Karma

lmyrefelt
Builder

aaah yeah, but you need to some configuration on the windows side to have another windows server act as a "event log receiver" . This is were some of the things might get screwed up "already"

0 Karma

cchitten
Path Finder

It is a linux server that is acting as the receiver though.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...