×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
RoyceTheBiker
Explorer
Member since: ‎07-24-2020
‎08-07-2020
Community Statistics
Posts 6
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎07-24-2020
View All

Re: All monitors are working except /var/log/messa...

by in Splunk Enterprise
‎07-27-2020 08:32 AM
‎07-27-2020 08:32 AM
I found that the Splunk configurations for syslog get the hostname from the log file itself.  I set /etc/rsyslog.conf to have $PreserveFQDN on and now it is working correctly. ... View more

Re: All monitors are working except /var/log/messa...

by in Splunk Enterprise
‎07-24-2020 03:14 PM
‎07-24-2020 03:14 PM
I just found that the /var/log/messages are being sent to the Splunk server, but the hostname is the short name, not the FQDN that I was looking at. Under the host=<short name> the only source is /var/log/message.   I will look to see if there is another spot where the short name is used and forces this. ... View more

Re: All monitors are working except /var/log/messa...

by in Splunk Enterprise
‎07-24-2020 02:08 PM
‎07-24-2020 02:08 PM
The only splunk lines in the audit.log is for when systemd restarts the service. ... View more

Re: All monitors are working except /var/log/messa...

by in Splunk Enterprise
‎07-24-2020 02:04 PM
‎07-24-2020 02:04 PM
SE is disabled.  This looks like there are no errors with the config files. /var/log/messages Jul 24 20:20:43 devtools splunk: All installed files intact. Jul 24 20:20:43 devtools splunk: Done Jul 24 20:20:43 devtools splunk: All preliminary checks passed. Jul 24 20:20:43 devtools splunk: Starting splunk server daemon (splunkd)... Jul 24 20:20:43 devtools splunk: Done ... View more

Re: All monitors are working except /var/log/messa...

by in Splunk Enterprise
‎07-24-2020 01:47 PM
‎07-24-2020 01:47 PM
Both messages and secure are root:root 600.  The UF (splunkd) is being run by root so is also the process-runner. ... View more

Why are all monitors working except /var/log/messa...

by in Splunk Enterprise
‎07-24-2020 01:12 PM
‎07-24-2020 01:12 PM
I copied the default inputs.conf to local and added some monitor configurations. There are seven monitors setup but only six are reporting. /var/log/messages is not working. [monitor:///var/log/messages] disabled = false #index = linuxlog sourcetype = syslog [monitor:///var/log/secure] disabled = 0 sourcetype = linux_secure The logs from secure do show up and the other monitors are working as expected. I have tried with ``disabled = 0``, also with and without index and sourcetype.  All the examples I am finding indicate that this should be working.  ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎08-07-2020 01:23 PM