Splunk Search

using transaction to check service status

abdallah_hegazy
Explorer

Hi :slightly_smiling_face:

we have McAfee Solidifier (software for real-time change monitoring to software code and servers configuration ) .

Solidifier is installed on users PC's ,but unfortunately users with administrative privileges can stop Solidifier services and hence stop monitoring !!

Using Splunk , we are monitoring McAfee Solidifier service status if it's running or stopped but
when user's PC is going to halt ( shutdown) , windows system will generate a message that McAfee Solidifier service has stopped then another message that system will shutdown .

like this :

Message=The McAfee Solidifier service entered the stopped state.

Then :

Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z.

i need to get alert only when Solidifier service is stopped but no shutdown event is generated after it (as in normal shutdown process )

i used this query but it's not working as expected :

index="*" EventType=4 | transaction ComputerName startswith="The McAfee Solidifier service entered the stopped state" endswith=search(body!="The operating system is shutting"* ) maxpause=60s

kindly find log events sample below :

04:14:56 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=QC2
TaskCategory=The operation completed successfully.
OpCode=The operation completed successfully.
RecordNumber=408853
Keywords=Classic
Message=The McAfee Solidifier service entered the stopped state.


04:15:00 PM
LogName=System
SourceName=Microsoft-Windows-Kernel-General
EventCode=13
EventType=4
Type=Information
ComputerName=QC2
TaskCategory=None
OpCode=Info
RecordNumber=408854
Keywords=None
Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z

Thanks .

0 Karma

woodcock
Esteemed Legend

First, avoid transaction; try this:

index="*" EventType=4 ("The McAfee Solidifier service entered the stopped state" OR "The operating system is shutting")
| reverse | streamstats count(searchmatch("The McAfee Solidifier service entered the stopped state")) AS SessionID BY ComputerName
| reverse | streamstats current=f last(_time) AS next_time BY SessionID ComputerName
| eval delta = next_time - _time
| where isnull(next_time) OR delta<=60

This will show every "stop event" which either does not have a "shutdown" event (or has one, but it is father than 60 seconds later). I think probably you do not need the delta stuff at all (you probably only had that to keep transaction from blowing up).

0 Karma

abdallah_hegazy
Explorer

@ woodcock Thanks a lot for your kind support :slightly_smiling_face:
i will check and follow up soon . Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...