About remy06

remy06 · ‎10-29-2010

Hi, I will like to check what are the type of security related events that websphere has or how and what is it being tracked? I've just installed the Splunk for Websphere app and managed to bring in some events,but from the security dashboard I can only see some events for SSL certificates and warnings, the others remain blank as no results found. How do I enable the rest? I've read up on some information and understand that websphere mainly deals with system and performance events,not much on security aspect? What are the type of security events that we can tracked in websphere and how do I enable it?Howabout user login/logout events?

remy06 · ‎10-29-2010

Thanks.Have attempted enabling some of the steps.Besides that,for a normal user account,am I right to say that they are unable to view,edit,delete Splunk logs and the data collected except for root?So the data collected is located at $SPLUNK_HOME/var/lib/splunk ?

remy06 · ‎10-28-2010

Hi, A quick question on how secure are our logs being stored in Splunk? Understand the access rights for log files located in /opt/splunk/var/log/splunk only allows root to have read/write access. How about those logs that Splunk received? How can we check or be sure that they are securely stored? Thanks.

remy06 · ‎10-21-2010

Thanks for the reply. When I changed my password earlier,I did log on to the domain using the new password,and was unable to do so using the old password already. Therefore I wanted to test my Splunk login as well and happen to be able to log in using both old and new.I did check and my account is LDAP-enabled. Anyway,I've just tested and relog into Splunk now and it is accepting my new password now.So I guess its probably what you've mentioned,that the new password hasn't been replicated or so.

remy06 · ‎10-21-2010

Am not sure what went wrong here. But I've tested and started using WMI alternative to pull events from this server instead.

remy06 · ‎10-21-2010

Hi, We have configured to use Splunk LDAP authentication and have been able to login to Splunk using our AD credentials. I've just changed my password and Splunk shouldn't allow me to login using my old password. However,I am still able to login using my old password as well as the new password now. Any idea on this?

remy06 · ‎10-21-2010

It is already configured not to "store a local copy of forwarded events". This serverA is used to pull WMI events from serverB which filters off some windows events and the forwards them to Splunk indexer. It is at the same time forwarding local events to Splunk indexer.In this case is it indexing and forwarding as well?

remy06 · ‎10-20-2010

don't know why but after I meddle around with the naming..it seems to work after that.. props.conf [wmi] TRANSFORMS-wminull = wmi-null, wmi-parsing [wmi-null] REGEX = (?msi)^EventCode=(538|540|672|673|861)\b DEST_KEY = queue FORMAT = nullQueue [wmi-parsing] REGEX = (?msi)^EventCode=578.*^(Type=Audit Success) DEST_KEY = queue FORMAT = nullQueue

remy06 · ‎10-20-2010

Hi, I have installed Splunk on serverA. ServerA is configured to monitor local events and at the same time is pulling WMI events from serverB. It is configured as a regular forwarder and is forwarding both events to our Splunk indexer. When I login to Splunkweb at ServerA,I get a notice bar at the top of the page stating "Daily indexing volume limit exceeded". Is there any concern for this as it is already configured as a forwarder? Will it have any effect on the events being indexed?

remy06 · ‎10-19-2010

Hi, I am currently testing out two searches to report and alert on the daily indexed volume. The first search is as follows.: index=_internal sourcetype=splunkd LicenseManager-Audit todaysBytesIndexed licenseSize | eval todayMb=(todaysBytesIndexed/1024/1024) | eval percentUsed=round(100*todayMb/licenseSize,2) The second search will have: index=_internal source=*metrics.log splunk_server="*" group="per_host_thruput" | eval MB=kb/1024 | chart sum(MB) by series | sort sum(MB) | addcoltotals col=t | fillnull value="[ Total Indexed Volume ] last 24 hours" Host(s) Both are scheduled to run at midnight daily and should report on the indexed volume for that day. However,I've noticed the reports for today,these 2 searches show different indexed volume which are misleading. Which command is more accurate?Any suggestion or advice?

remy06 · ‎10-19-2010

I monitored the events after ive made the changes and still see them

remy06 · ‎10-19-2010

Am using a regular forwarder

remy06 · ‎10-19-2010

This is working for me now..although there isn't much difference than the previous but here goes: [setnull] REGEX = (?msi)^EventCode=(540|673|861)\b DEST_KEY = queue FORMAT = nullQueue

remy06 · ‎10-19-2010

Hi, Thanks for the suggestions. This is working for us by capturing eventcode 578 AND Type=Audit Success : REGEX = (?msi)^EventCode=578.*^(Type=Audit Success)

remy06 · ‎10-19-2010

There are 3 machines, hostA,hostB(both windows) & splunk indexer(linux). I have splunk installed on hostB and have configured with the above scripts to pull event logs from hostA, and then forward them to Splunk indexer.

remy06 · ‎10-15-2010

Hi, My previous configuration to filter windows event codes doesn't work when I used it on another machine that is pulling data via WMI. My objective is to filter off event codes 538,540,672,673,861 and "Success Audit" type for code 578. My existing configuration is: props.conf [wmi] TRANSFORMS-null = setnullevents, setparsing transforms.conf [setnullevents] REGEX = (?m)^EventCode=(538|540|672|673|861)\b DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = (?msi)^EventCode=578.*^(Type=Audit Success) DEST_KEY = queue FORMAT = nullQueue Any idea what I've missed?

remy06 · ‎10-11-2010

Splunk does not require a reboot to uninstall if Im not wrong.I simply uninstall the previous version of Splunk at C:\, before I attempt to install it again on D:\

remy06 · ‎10-08-2010

Hi, I have to reinstall Splunk on a different drive(from C:\ to D:) on our Windows 2003 domain controller. When I tried to install again I've encountered these errors: 1) Splunk installer was unable to enable Windows App Splunk exicode = '2' I closed it,it continues and encountered the 2nd error: 2) Splunk installer was unable to start Splunk services Please make sure you have provided the correct username and/or password,and the user you are trying to run Splunk as has the correct privileges. Exicode='1' I've checked sevices.msc and splunkd and splunkweb are listed, but unable to start. I have tried to install using the domain administrator account,and a user account that was given administrator privileges but both unsuccessful. Now even when I tried to uninstall Splunk,splunkd and splunkweb doesn't get removed from services.msc, even after a reboot of the server.

remy06 · ‎10-07-2010

I see..thanks it works fine.

remy06 · ‎10-06-2010

thanks for the prompt reply. Do I specify the commands you've provided in props.conf? Here is a list of examples where it contains 5 columns: (eg. event-FS_CHdir, login-user3, status-OK, time, command - tsm,su)etc I'm trying to extract these fields for the 5 columns. FS_Chdir user3 OK Tue Oct 26 11:10:49 2004 tsm change current directory to: /home/user3 S_ENVIRON_WRITE user3 FAIL Tue Oct 26 11:10:49 2004 tsm audit object write event detected /etc/security/environ S_PASSWD_READ user3 OK Tue Oct 26 11:10:50 2004 su audit object read event detected /etc/security/passwd S_PASSWD_READ user3 OK Tue Oct 26 11:10:50 2004 su audit object read event detected /etc/security/passwd USER_SU user3 OK Tue Oct 26 11:10:53 2004 su root AUD_Proc user1 OK Thu Sep 16 15:09:45 2010 audit pid: 0 cmd: 4 TCB_Exec user1 OK Thu Sep 16 15:09:45 2010 audit filename: /usr/sbin/audit CRON_Start root OK Tue Oct 05 23:40:00 2010 cron

remy06 · ‎10-06-2010

Hi, I am trying to extract fields from events and here are the sample events: AUD_Proc user1 OK Thu Sep 16 15:09:45 2010 audit pid: 0 cmd: 4 TCB_Exec user1 OK Thu Sep 16 15:09:45 2010 audit filename: /usr/sbin/audit CRON_Start root OK Tue Oct 05 23:40:00 2010 cron S_PASSWD_READ root OK Tue Oct 05 23:40:00 2010 java I am tring to extract the "login" field (user1,root) but the generated pattern doesn't match all values. For example,if i selected user1 and root as the example values,the pattern generated only captures event for TCB_Exec,and not other events like AUD_Proc,CRON_Start & S_PASSWD_READ.

remy06 · ‎10-01-2010

I have about 8 files of the same kind of event logs which I require Splunk to index. Splunk managed to index 6 of them while the remaining 2 got the following error: ERROR TailingProcessor - Ignoring path due to: File will not be read, seekptr checksum did not match (file=/myfile/test.out). Last time we saw this initcrc, the filename was different. You may wish to use a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue">http://www.splunk.com/page/submit_issue for more info.

remy06 · ‎09-13-2010

Hi, I've tried to do a search based on custom time. For example,I've chosen from the drop down box > Custom time > Under earliest time I've selected "09/10/2010 00:00:00.000" and latest time as "09/11/2010 00:00:00.000" which displayed events on friday 10 september. However under the timeline the date displayed is: ≥ 62,061 events during Thursday, September 9, 2010 Is it a bug in Splunk?

remy06 · ‎08-20-2010

Hi, Seems to have problems with it now.It's been working fine for the past few days.. Sample of the event: ......,EXTENDED_TIMESTAMP="20/08/10 12:59:21.994681 AM +08:00".... props.conf [myevent] TIME_PREFIX = EXTENDED_TIMESTAMP=" TIME_FORMAT = %d/%m/%y %I:%M:%S.%6N %p SHOULD_LINEMERGE = true This morning I've noticed the dates are specified in splunk as: 10/12/08 12:59:21.994 AM Any idea?

remy06 · ‎08-20-2010

I'm trying to monitor who does what at times like create files,delete files,write to files etc

Posts	123
Solutions	10
Karma Given	0
Karma Received	32
Member Since	‎05-05-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

extract events for specific time period

splunk for AS400 data input configuration issues

Received PDF Report but no result shown

configuring data for splunk palo alto

Filtering events not working

File monitoring issues

Results table no display on user's browser

regex field extraction question

data input & forwarding on universal forwarders

How to detect splunkd shutdown for forwarders?

Question on Websphere security events?

Re: How secure are the logs stored once received b...

How secure are the logs stored once received by Sp...

Re: Why am I able to re-use previous password for ...

Re: Encounter errors when installing Splunk forwar...

Why am I able to re-use previous password for Splu...

Re: Daily indexing volume limit exceeded shown on ...

Re: Filtering windows events not working after swi...

Daily indexing volume limit exceeded shown on forw...

Splunk search command for daily indexed volume?

Re: Filtering windows events not successful on spl...

Re: Filtering windows events not successful on spl...

Re: Filtering windows events not successful on spl...

Re: How to filter off winevent code to capture onl...

Re: Filtering windows events not working after swi...

Filtering windows events not working after switchi...

Re: Encounter errors when installing Splunk forwar...

Encounter errors when installing Splunk forwarder ...

Re: REGEX help on field extraction?

Re: REGEX help on field extraction?

REGEX help on field extraction?

ERROR TailingProcessor - Ignoring path

Invalid display for custom time search?

Re: Unable to capture correct timestamp?

Re: Monitoring of specific files and folders

Join the Conversation