Splunk Search

splunk query to list if anyone removed logs from unix server(syslog servers)?

pavanae
Builder

Base query :- sourcetype=syslog

How can I or where can I find if anyone removed any log files on unix syslog server?
what are the sample unix commands that used to remove any log files?

Any inputs would be highly appriciated.

0 Karma
1 Solution

koshyk
Super Champion

Your question is very broad.

  1. The system logrotation itself can remove/rotate logs. So it makes it difficult to detect who actually removed the log files
  2. You can implement audit in Linux systems and ensure the relevant files are monitored. You need to print-out auid, uid and all relevant information to detect who actually did modification or delete. Then you can onboard these audit data into Splunk
  3. You can employ a professional software (File Integrity monitor) software to check actions for specific file
  4. A cheap option is to detect file changes by writing a simple shell script and packaging this as a "scripted inputs" app to find file modified time, file creation time etc. A sample script is provided in this link and onboard into Splunk

View solution in original post

koshyk
Super Champion

Your question is very broad.

  1. The system logrotation itself can remove/rotate logs. So it makes it difficult to detect who actually removed the log files
  2. You can implement audit in Linux systems and ensure the relevant files are monitored. You need to print-out auid, uid and all relevant information to detect who actually did modification or delete. Then you can onboard these audit data into Splunk
  3. You can employ a professional software (File Integrity monitor) software to check actions for specific file
  4. A cheap option is to detect file changes by writing a simple shell script and packaging this as a "scripted inputs" app to find file modified time, file creation time etc. A sample script is provided in this link and onboard into Splunk

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!