Unable to view RHEL Audit Logs in Splunk

[bedwards]

My audit logs are not being sent to splunk. The inputs.conf file is configured to monitor everything under /var/log. Please see below. Any assistance would be helpful, Thanks.

[monitor:///var/log]
disabled=false
index=linux
sourcetype=linux_messages_syslog

I also tried to specify the log in the inputs.conf file as seen below. But still no luck.

[monitor:///var/log/audit/audit.log]
disabled=false
index=linux
sourcetype=linux_audit

[isoutamo]

If/when you are running UF as non root user, you must give access to those logs to that specific user. You could check if this is the issue by trying to use less/more to see the content of those files by splunk user.

r. Ismo

[bedwards]

I'm running UF as root user.

[isoutamo]

Can you see any logs e.g. internal from this UF or are those /var/logs only ones which are missing?

There are several other threads for troubleshooting log collections. Have you try those already?