Splunk Search

using transaction to check service status

abdallah_hegazy
Explorer

Hi 🙂

we have McAfee Solidifier (software for real-time change monitoring to software code and servers configuration ) .

Solidifier is installed on users PC's ,but unfortunately users with administrative privileges can stop Solidifier services and hence stop monitoring !!

Using Splunk , we are monitoring McAfee Solidifier service status if it's running or stopped but
when user's PC is going to halt ( shutdown) , windows system will generate a message that McAfee Solidifier service has stopped then another message that system will shutdown .

like this :

Message=The McAfee Solidifier service entered the stopped state.

Then :

Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z.

i need to get alert only when Solidifier service is stopped but no shutdown event is generated after it (as in normal shutdown process )

i used this query but it's not working as expected :

index="*" EventType=4 | transaction ComputerName startswith="The McAfee Solidifier service entered the stopped state" endswith=search(body!="The operating system is shutting"* ) maxpause=60s

kindly find log events sample below :

04:14:56 PM
LogName=System
SourceName=Microsoft-Windows-Service Control Manager
EventCode=7036
EventType=4
Type=Information
ComputerName=QC2
TaskCategory=The operation completed successfully.
OpCode=The operation completed successfully.
RecordNumber=408853
Keywords=Classic
Message=The McAfee Solidifier service entered the stopped state.


04:15:00 PM
LogName=System
SourceName=Microsoft-Windows-Kernel-General
EventCode=13
EventType=4
Type=Information
ComputerName=QC2
TaskCategory=None
OpCode=Info
RecordNumber=408854
Keywords=None
Message=The operating system is shutting down at system time ‎2016‎-‎03‎-‎30T13:15:00.728125000Z

Thanks .

0 Karma

woodcock
Esteemed Legend

First, avoid transaction; try this:

index="*" EventType=4 ("The McAfee Solidifier service entered the stopped state" OR "The operating system is shutting")
| reverse | streamstats count(searchmatch("The McAfee Solidifier service entered the stopped state")) AS SessionID BY ComputerName
| reverse | streamstats current=f last(_time) AS next_time BY SessionID ComputerName
| eval delta = next_time - _time
| where isnull(next_time) OR delta<=60

This will show every "stop event" which either does not have a "shutdown" event (or has one, but it is father than 60 seconds later). I think probably you do not need the delta stuff at all (you probably only had that to keep transaction from blowing up).

0 Karma

abdallah_hegazy
Explorer

@ woodcock Thanks a lot for your kind support 🙂
i will check and follow up soon . Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...