Security

How to Detect Backup Monitoring in Splunk

Splunk_Master01
Explorer

Hi All,

Is there a way in which Splunk can generate an alert when backup and restoration exercises are conducted.

Any use case that can do this?

Any assistance on this would be appreciated.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Splunk_Master01,

I suppose that you already have the back-up system logs.

At first, you have to analyze the logs of your back-up system finding the messages for start, end and status both for back-up and restore.

Then you have to define the back-up and restore time scheduling, and then create a search, schedule for e.g. one hour after the completion of the job.

For back-up, you could schedule a search e.g. every day (if your back-up frequency is 1 day).

So you should schedule an alert like the following.

index=your_index message IN ("back-up started", "back-up ended")
| stats earliest(_time) AS earliest latest(_time) AS latest values(message) AS message values(status) AS status
| eval duration=latest-earliest
| eval 
   earliest=strftime(earliest,"%Y-%m-%d %H:%M:%S"),
   latest=strftime(latest,"%Y-%m-%d %H:%M:%S")

Then if you want an alert only for status="failed", you can add a filter at the end of your search.

At the same time you could create a dashboard (with the above search) to display all the back-up times, durations, and statuses.

For restore, the process is the same, the only difference is that you surely have a dayly back-up, instead restore is probably scheduled with a minor frequency, so you have to schedule your alert with the correct frequency, to avoid false positive messages.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...