Windows Security some EventIDs not showing in Splunk

[n_hoh]

Hi All I've been tasked with setting up logging for Windows Certification Services and getting this into Splunk.

Have enabled the logging for Certification Services and can see the events for this in the Windows Security log, in Splunk I can see the Windows Security logs for the CA server however the Certification Services events are missing.

I've confirmed in the inputs.conf that the event IDs I'm looking for are whitelisted, does anyone have any other suggestions on what can be checked?

[PickleRick]

If I understand correctly, the events you're interested in are not in the Security eventlog but in another one (Certification Services\Operational?).

Since you've probably not created an input for this eventlog, you're not pulling events from it. You have to create inputs.conf stanza for that particular eventlog if you want it to be pulled from the server.

[n_hoh]

@PickleRick the events are in the Security eventlog which other than the event IDs related to cert services e.g. 4876, 4877, 4885, 4886, 4887, 4888, 4889 can be seen in Splunk. All these event IDs are whitelisted for the WinEventLog security channel in the inputs.conf

[PickleRick]

Question is whether you don't blacklist them (to be honest, I don't remember how whitelist/blacklist interact - which one prevails).

And about the thruput issue - it shouldn't drop events selectively - it would throttle output which in turn would throttle input so you would have a (possibly huge) lag ingesting events from this UF but it shouldn't just drop events.

Dropping events could occur in an extreme case if you lagged so much that windows rotated the underlying event log so that the UF couldn't read the events from a saved checkpoint. But that's relatively unlikely and you'd notice that becuse this UF would have been significantly delayed already.

[PrewinThomas]

@n_hoh 

Which event IDs are you looking for (4886, 4887, 4888, 4889, 4885)?
Assuming your CA server is running UF, Does Splunk drop high-volume events due to bandwidth throttling? If yes, try setting the throughput in limits.conf.

[thruput]
maxKBps = 0

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[n_hoh]

@PrewinThomas need to be capturing all event IDs associated with cert services, however for testing purposes was looking specifically for 4876, 4877. And yes the CA server is running universal forwarder.

Unsure how to check if Splunk is dropping high-volume events so if you could point me in the right direction for that I will check on that , however looking at the event logs on the CA server would not say these events are particularly high-volume <100 in the past week across all the events for cert services.

[PrewinThomas]

@n_hoh 
Can you share your inputs.conf and event flow(like UF->HF->Idx)