About jorob

jorob · ‎03-08-2024

We finally got stream working - but more of a work around. The problem is in part due to starting the UF using systemd, which allocates CPU slices for different processes. When using systemd to start the UF, stream fails. Disabling start on boot, and manually starting the UF from ./slunk start, stream works. The second part is that when the UF starts, ownership of all the UF files is chowned splunk:splunk. This seems logical to ensure the UF runs as splunk (or splunkfwd). However, when stream is initially installed, the set_permissions.sh changes ownership of ../Splunk_TA_stream/Linux_x86_64/streamfwd-rhel6 to root. Starting the UF undoes this, changing ownership back to splunk. We made streamfwwd-rhel6 immutable - which did prevent the ownership change back to splunk, but stream still failed when starting with systemd. Ultimately, we had to disable systemd, make streamfwd-rhel6 immutable (after running set_permissions.sh), then start the UF manually via /splunk start. Splunk needs to fix this so stream works as expected without having to disable boot-start and set the immutable flag.

jorob · ‎04-21-2021

I recently installed SC4S. For most logs it works as expected; however, it is improperly indexing Juniper Netscreen as osnix with sourctype: nix:syslog. I've tried adding a filter to identify specific IPs as netscreen but it did not work. Any assistance is appreciated Example Raw Log: <133>Apr 19 20:06:42 172.#.#.2/172.#.#.2 SC-NS1-SSG140: NetScreen device_id=SC-NS1-SSG140 [Root]system-notification-00257(traffic): start_time="2021-04-21 17:13:42" duration=0 policy_id=320001 service=tcp/port:8013 proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=52 src=10.#.#.133 dst=10.#.#.1 src_port=53563 dst_port=8013 session_id=0 reason=Traffic Denied Splunk Results SC-NS1-SSG140: NetScreen device_id=SC-NS1-SSG140 [Root]system-notification-00257(traffic): start_time="2021-04-21 17:13:42" duration=0 policy_id=320001 service=tcp/port:8013 proto=6 src zone=Null dst zone=self action=Deny sent=0 rcvd=52 src=10.#.#.1 dst=10.#.#.133 src_port=53563 dst_port=8013 session_id=0 reason=Traffic Denied host = 172.#.#.2/172..#.#.2 index = osnix sc4s_fromhostip = 172.#.#.150 sc4s_syslog_facility = user sc4s_syslog_format = rfc3164 sc4s_vendor_product = nix_syslog source = program:SC-NS1-SSG140 sourcetype = nix:syslog

jorob · ‎09-09-2020

Hi, Yes, the juniper folder was created. And storage was a typo/error, it is supposed to be syslog. Thanks jorobb

jorob · ‎09-09-2020

Thank you for your reply, I was able to get the sourcetype working using props and transformed. However, information you provided will definitely benefit me in future troubleshooting. I have a long way to go before everything is fixed and am sure to run into similar problems as we move forward. Thanks again! Jorobb

jorob · ‎09-09-2020

Thank you for the reply, I ended up taking a different approach with props and transforms and using regex to identify juniper logs and assign the sourcetype., which worked (although now the challenge is getting it to work with the Juniper Addon and CIM). That said, I'm relatively new to Splunk and wondering if that's the best solution, or should the solution be more inline with what you outlined. For the juniper logs, (all the same format), file system hierarchy is /mnt/syslog/YEAR/MONTH/juniper/<file>, however the primary syslog monitor is /mnt/syslog/YEAR/MONTH/<file>, which is where everything is dumped, except for what is identified as juniper, which now goes to the /juniper/<file>. Juniper logs are just the first ones we looked to properly identify, we still have to go back and break out the remaining source types such as apache, linux_secure, asterisk_*, access_combined, operating systems, etc... It's a bit of a mess to clean up without disruption current work flows. Thanks again! jrobb

jorob · ‎09-08-2020

Hello, I recently started with a company that has a syslog-ng server saving logs to /mnt/syslog/$year/$month/<filename> and onboarded to splunk as sourcetype syslog and index main. I need to begin on-boarding data by the actual sourcetype The current monitor stanza is [monitor:\\\mnt\syslog]. The $year and $date are part of log rotation with from the previous month being archived and deleted and only logs in the current year and month are updated and pulled into Splunk. We are starting with Juniper for onboarding by sourcetype. I updated syslog-ng.conf to write juniper logs into their own folder and setup the following a monitor in inputs.conf [monitor: ///mnt/storage/.../juniper]. sourcetype = juniper host_segment = 5 However, I am unable to get Splunk to see anything in the juniper folder. When I list monitor from the CLI, it only shows /mnt/storage/$year/$month. Also, due to network restrictions, we are currently not are not sending via udp/tcp. Everything has to be onboarded via file (for now). I have tried different variations for the monitor stanza to include ///mnt/syslog/*/juniper, ///mnt/syslog/.../.../juniper, ///mnt/syslog/*/juniper/ to list a few. I have also used the CLI to "add monitor /mnt/syslog/.../juniper -sourcetype juniper, with the same results. Any recommendations? Or is more information needed? Thanks

jorob · ‎07-01-2020

We recently upgraded splunk from 6.05 to 8.03. Afterwards, realized numerous alerts are using flashtimeline view, which no longer works. Is there a way to update the alerts to search view or timechart?

Posts	7
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎07-01-2020

Online Status	Offline
Date Last Visited	‎03-11-2024 04:10 PM

SC4S, Properly Indexing Juniper Netscreen

Onboardering Data from Syslog-ng server

flashtimeline

Re: streamfwd app error in /var/log/splunk/streamf...

SC4S, Properly Indexing Juniper Netscreen

Re: Onboardering Data from Syslog-ng server

Re: Onboardering Data from Syslog-ng server

Re: Onboardering Data from Syslog-ng server

Onboardering Data from Syslog-ng server

flashtimeline

Are you a member of the Splunk Community?