Registry Monitoring returning no events

[kholleran]

Hello,

I am trying to monitor the registry of remote forwarders. I have the following in my regmon.conf

[default]
disabled = 0
baseline = 0
#30 days
#baseline_interval = 2592000

# Monitor all registry keys under the HKEY_CURRENT_USER Registry hive for 
# "set," "create," "delete," and "rename" events created by all processes.
# Store the events in the "regmon" splunk index

[USBSTOR]
proc = .*
hive = \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
type = set|create|delete|rename
index = default
baseline = 0
disabled = 0

[USB]
proc = .*
hive = \REGISTRY\MACHINE\SYSTEM\CurrentControlSet\Enum\USB
type = set|create|delete|rename
index = default
baseline = 0
disabled = 0

I am trying to monitor when a USB device is plugged in. I am using deployment server to deploy this as an app, I see it show up in deployment-client, & I see the keys showing in the reg input on the forwarder... I then walk to the device, plug in a USB flash drive, watch the registry change, but no events ever show up!

Can anyone see anything I am doing wrong?

Thanks for your help.

Kevin

[r0otux]

I realize this post is old, but do you recall what the index line should read or reference to? Thanks in advance for any help.

[kholleran]

AHHHHH!!!! Fixed... the index line was incorrect as that is not the index I want it going to so that was messing it up.

[kholleran]

Someone help!!!! I need to get this to work by tomorrow morning!!! I cannot understand why this is not working!!!

[kholleran]

Has anyone done anything like this? I want to alert when a new USB device is plugged in....

Thanks.

[kholleran]

I am thinking I need to double-slash to escape. Did this & now I have no errors, but made a change in the registry and nothing is coming across....

[kholleran]

I see the following in Splunkd.log:

splunk-regmon - WinRegistryMonitor::configure: Failed to get configuration settings: 'Regex: PCRE does not support \L, \l, \N{name}, \U, or \u'