Getting Data In

Windows eventlog can not be collected by Universal Forwarder

jichen
Explorer

I have some windows machine to collect their eventlog, most of them works fine, but several of them can not send data to indexer server.
They're win2008R2 with same forwarder agent and configuration, the inputs.conf set as below
[WinEventLog:Application]
index=main
[WinEventLog:Security]
index=main
[WinEventLog:System]
index=main

I'm sure the network is fine,and the server also received the agent itself log in _internal database,but no windows log at all. I see the forwarder's log ,it record like something 'wmi.exe read 0.434 second, 0 byte read', but I'm sure there're plenty of events in the windows system. I clear the windows event log and restart the forwarder agent, the problem remains.
How to solve this issue, I think it's due to the windows OS itself,maybe the .DLL problem? Someone met the same problem?

0 Karma

jichen
Explorer

Hi, I haven't done the troubleshooting yet, but I reinstall the agent and select the monitor option(security,system,application),then it's ok,but when I manually config the inputs.conf, no stuff indexed again.

0 Karma

Ayn
Legend

Not an answer per se, but some troubleshooting tips:
1. Use amrit's script to check what status Splunk has for each input. http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/
2. Check splunkd.log on the forwarder for hints on what could be wrong.

0 Karma

Keysofsandiego
Path Finder

Im still a newb myself but try adding the disabled switch to your inputs.conf.

[WinEventLog://Security]
disabled = 0
index = windows

[WinEventLog://Application]
disabled = 0
index = windows

[WinEventLog://System]
disabled = 0
index = windows

Also, you might want to make sure the outputs.conf is also configured too... example below.

[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = YOURSPLUNKSERVER:PORT

[tcpout-server://YOURSPLUNKSERVER:PORT]

Hope this helps.
Happy Splunking!
=)

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...