Splunk Search

splunk query to list if anyone removed logs from unix server(syslog servers)?

pavanae
Builder

Base query :- sourcetype=syslog

How can I or where can I find if anyone removed any log files on unix syslog server?
what are the sample unix commands that used to remove any log files?

Any inputs would be highly appriciated.

0 Karma
1 Solution

koshyk
Super Champion

Your question is very broad.

  1. The system logrotation itself can remove/rotate logs. So it makes it difficult to detect who actually removed the log files
  2. You can implement audit in Linux systems and ensure the relevant files are monitored. You need to print-out auid, uid and all relevant information to detect who actually did modification or delete. Then you can onboard these audit data into Splunk
  3. You can employ a professional software (File Integrity monitor) software to check actions for specific file
  4. A cheap option is to detect file changes by writing a simple shell script and packaging this as a "scripted inputs" app to find file modified time, file creation time etc. A sample script is provided in this link and onboard into Splunk

View solution in original post

koshyk
Super Champion

Your question is very broad.

  1. The system logrotation itself can remove/rotate logs. So it makes it difficult to detect who actually removed the log files
  2. You can implement audit in Linux systems and ensure the relevant files are monitored. You need to print-out auid, uid and all relevant information to detect who actually did modification or delete. Then you can onboard these audit data into Splunk
  3. You can employ a professional software (File Integrity monitor) software to check actions for specific file
  4. A cheap option is to detect file changes by writing a simple shell script and packaging this as a "scripted inputs" app to find file modified time, file creation time etc. A sample script is provided in this link and onboard into Splunk
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...