using transaction to check service status

[abdallah_hegazy]

Hi 🙂

we have McAfee Solidifier (software for real-time change monitoring to software code and servers configuration ) .

Solidifier is installed on users PC's ,but unfortunately users with administrative privileges can stop Solidifier services and hence stop monitoring !!

Using Splunk , we are monitoring McAfee Solidifier service status if it's running or stopped but
when user's PC is going to halt ( shutdown) , windows system will generate a message that McAfee Solidifier service has stopped then another message that system will shutdown .

like this :

Message=The McAfee Solidifier service entered the stopped state.

Then :

Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z.

i need to get alert only when Solidifier service is stopped but no shutdown event is generated after it (as in normal shutdown process )

i used this query but it's not working as expected :

index="*" EventType=4 | transaction ComputerName startswith="The McAfee Solidifier service entered the stopped state" endswith=search(body!="The operating system is shutting"* ) maxpause=60s

kindly find log events sample below :

04:14:56 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=QC2
TaskCategory=The operation completed successfully.
OpCode=The operation completed successfully.
RecordNumber=408853
Keywords=Classic
Message=The McAfee Solidifier service entered the stopped state.


04:15:00 PM
LogName=System
SourceName=Microsoft-Windows-Kernel-General
EventCode=13
EventType=4
Type=Information
ComputerName=QC2
TaskCategory=None
OpCode=Info
RecordNumber=408854
Keywords=None
Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z

Thanks .

[woodcock]

First, avoid transaction; try this:

index="*" EventType=4 ("The McAfee Solidifier service entered the stopped state" OR "The operating system is shutting")
| reverse | streamstats count(searchmatch("The McAfee Solidifier service entered the stopped state")) AS SessionID BY ComputerName
| reverse | streamstats current=f last(_time) AS next_time BY SessionID ComputerName
| eval delta = next_time - _time
| where isnull(next_time) OR delta<=60

This will show every "stop event" which either does not have a "shutdown" event (or has one, but it is father than 60 seconds later). I think probably you do not need the delta stuff at all (you probably only had that to keep transaction from blowing up).

[abdallah_hegazy]

@ woodcock Thanks a lot for your kind support 🙂
i will check and follow up soon . Thanks