Monitoring Splunk

Unable to view RHEL Audit Logs in Splunk

bedwards
Loves-to-Learn Lots

My audit logs are not being sent to splunk. The inputs.conf file is configured to monitor everything under /var/log. Please see below. Any assistance would be helpful, Thanks.

[monitor:///var/log]
disabled=false
index=linux
sourcetype=linux_messages_syslog

 

I also tried to specify the log in the inputs.conf file as seen below. But still no luck.

[monitor:///var/log/audit/audit.log]
disabled=false
index=linux
sourcetype=linux_audit

 

Labels (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If/when you are running UF as non root user, you must give access to those logs to that specific user. You could check if this is the issue by trying to use less/more to see the content of those files by splunk user.

r. Ismo

0 Karma

bedwards
Loves-to-Learn Lots

I'm running UF as root user.

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Can you see any logs e.g. internal from this UF or are those /var/logs only ones which are missing?

There are several other threads for troubleshooting log collections. Have you try those already?
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!