About kkuminsky

kkuminsky · ‎06-17-2010

If somebody cares, we've finally found the reason for such weird behavior. Account that we use to run Splunk services didn't have appropriate permissions over C:\Program Files\Splunk\var\lib\splunk\persistentstorage folder. It looks like Splunk service was failing to update information in it's internal records when monitored file is changed. The difficulty was that Windows file audit wasn't showing any failed access attempts for Splunk directory. We had to use Process Monitor from Sysinternals to see which files Splunk is trying to access and double-check the permissions. Conclusion is that if you change account to run Splunk services, make sure it has full control over Splunk directory and all its sub-folders. Also, Windows 2008 sometimes doesn't properly propagate permissions to sub-folders when you change them for parent folder.

kkuminsky · ‎06-16-2010

I've opened a support case but haven't heard anything back yet. Also, I've upgraded to the latest version (4.1.3-80534) but it's still the same.

kkuminsky · ‎06-14-2010

Thank you for the answer. I would expect such behavior too, but that's not what I'm getting. Please, see the following post with some details: http://answers.splunk.com/questions/3609/fschange-file-monitoring/3626#3626 ("fschange file monitoring")

kkuminsky · ‎06-14-2010

Thank you for the reply. I've enabled file access audit to make sure no other process is accessing the file. There are only Splunk read attempts every 60 seconds: An attempt was made to access an object. Subject: Security ID: TEIG-LOG\Splunk Account Name: Splunk Account Domain: TEIG-LOG Logon ID: 0x2a57e87a7 Object: Object Server: Security Object Type: File Object Name: C:\TEMP\configs.txt Handle ID: 0x6a0 Process Information: Process ID: 0x660 Process Name: C:\Program Files\Splunk\bin\splunkd.exe Access Request Information: Accesses: READ_CONTROL Access Mask: 0x20000 Here is what search for duplicate events returns: host action path size modtime mode count 2 TEIG-LOG add C:\TEMP\configs.txt 388 Mon Jun 14 09:17:56 2010 rwxrwxrwx 14 So you are saying it may be a bug? I'm running version 4.0.9, build 74233

kkuminsky · ‎06-14-2010

A few things: inputs.conf is on the server where Splunk is installed. That's where you should add stanza. I don't see such parameter as "host=" for fschange. Please, go through the following article about fschange (http://www.splunk.com/base/Documentation/4.0.9/Admin/Monitorchangestoyourfilesystem). If you want to monitor files or folder on the remote server, you probably wanna use a network path. Something like [fschange:\\abc.int.hlc.com\e$\testfschange] Was mysamples index created for this particular monitoring task or there are already events in there? You may wanna try any index with existing events first to make sure it's not an index file issue. If you are going to monitor files through the network, make sure Splunk services are running under the accounts that have appropriate permissions (http://www.splunk.com/base/Documentation/latest/Installation/InstallonWindows#Choosing_the_user_Splunk_should_run_as).

kkuminsky · ‎06-14-2010

Is fschange supposed to generate an even each time it checks or only if a file was changed since the last check? According to the following article, http://www.splunk.com/base/Documentation/4.0.9/Admin/Monitorchangestoyourfilesystem: generates an event (in Splunk) when that directory undergoes any change. However that's not what I'm getting when trying to monitor folder. I'm getting a message like this one each 60 seconds: 6/14/10 9:20:52.000 AM Mon Jun 14 09:20:52 2010 action=add, path="C:\TEMP\configs.txt", isdir=0, size=388, gid=-1, uid=-1, modtime="Mon Jun 14 09:17:56 2010", mode="rwxrwxrwx", hash= What am I doing wrong? inputs.conf: [fschange:C:\TEMP\] index = main recurse = false followLinks = false signedaudit = false fullEvent = false sendEventMaxSize = 1048576 delayInMills = 1000 pollPeriod = 60

kkuminsky · ‎06-14-2010

If I specify pollPeriod parameter for fschange, is it supposed to generate an event each time it checks file for changes or only if it checks and finds that the file was changed? I monitor for changes separate files as well as folders. Is pollPeriod supposed to work for separate file monitoring also or for folder monitoring only?

kkuminsky · ‎06-10-2010

I've set up file monitoring with fschange: [fschange:C:\TEMP\test.txt] index = main recurse = false followLinks = false signedaudit = false fullEvent = false sendEventMaxSize = 1048576 delayInMills = 1000 pollPeriod = 60 What's happening is that every 60 seconds it generates update event. File is not modified. Modified time in all these events is the same. 6/10/10 3:28:09.000 PM Thu Jun 10 15:28:09 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime " 6/10/10 3:27:08.000 PM Thu Jun 10 15:27:08 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime " 6/10/10 3:26:07.000 PM Thu Jun 10 15:26:07 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime " 6/10/10 3:25:06.000 PM Thu Jun 10 15:25:06 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime " 6/10/10 3:24:05.000 PM Thu Jun 10 15:24:05 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime " Any thoughts why it's happening?

kkuminsky · ‎06-10-2010

OK, the reason it was not working is that Splunk services were running under Local System account. Here are the articles I used to fix it: http://www.splunk.com/base/Documentation/latest/Installation/InstallonWindows#Choosing_the_user_Splunk_should_run_as http://www.splunk.com/base/Documentation/latest/Installation/CorrectingtheuserselectedduringWindowsinstallation

kkuminsky · ‎06-10-2010

It appears that it's working for local files - [fschange:C:\TEMP\test.txt], but not for network - [fschange:\10.255.1.20\Siteroot\Web.config] So, I guess the question is how to monitor files on other machines in the network.

kkuminsky · ‎06-10-2010

Yes, you are right. It looks like I shouldn't rely that much on GUI. So, I've changed the config (see below). Now I don't see this record in Splunk Manager under Data Inputs anymore. Also, when I make changes to the file I'm still not able to find any records when doing search. [fschange:\10.255.1.20\Siteroot\Web.config] index = main recurse = true followLinks = false signedaudit = false fullEvent = true sendEventMaxSize = 1048576 delayInMills = 1000 pollPeriod = 60

kkuminsky · ‎06-09-2010

Trying to monitor changes to configuration files. Followed this article: http://www.splunk.com/base/Documentation/4.0.9/Admin/Monitorchangestoyourfilesystem Created Data Input in Splunk Manager. Here is the inputs.conf (added pollPeriod manually): [monitor://\192.168.1.12\Siteroot\Web.config] disabled = false host = SIT-APP-shared host_regex = host_segment = index = main sourcetype = pollPeriod = 60 Restarted splunk after changes, share has full permissions for everyone. Then I change web.config file. Do search in Splunk - nothing. Does the configuration look right? How do I debug it to see if it's connecting to the share, how often, error messages etc.?

kkuminsky · ‎05-19-2010

Guys, thank you for the detailed info. I'm new to splunk and I'm impressed by it's search functionality. So, I've adopted this one: eval Account_Name=mvindex(Account_Name, -1) | ... Mostly because: There are some events that have "-" value for both Account_name fields I'm expecting different values for the first account field, not only "-", but the one that I'm interested in is the second one.

kkuminsky · ‎05-18-2010

In the following Windows event log message field Account Name appears twice with different values. When I build a report by Account Name it looks like there were two events instead of one, because Splunk is indexing Account Name twice in this case. Is there a way to avoid indexing the first one (under subject)? LogName=SecuritySourceName=Microsoft Windows security auditing. EventCode=4625 EventType=0 Type=Information ComputerName=AD1.TEIG.production TaskCategory=Logon OpCode=Info RecordNumber=1371401 Keywords=Audit FailureMessage=An account failed to log on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: APP2$ Account Domain: TEIG.PRODUCTIONFailure Information: Failure Reason: An Error occured during Logon. Status: 0xc0000133 Sub Status: 0x0

kkuminsky · ‎05-17-2010

Is there a way to add an additional field to every event for acknowledgment? I'm analyzing failed login attempts. As some of them happened for a known reason I'd like to mark them somehow in the final report.

Posts	15
Solutions	2
Karma Given	3
Karma Received	5
Member Since	‎05-17-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

fschange file monitoring

fschange pollPeriod parameter

fschange generates false update events

Monitoring changes to configuration files

Same fields with different values in one event

Additional field - event acknowledgment

Re: fschange file monitoring

Re: fschange file monitoring

Re: fschange pollPeriod parameter

Re: fschange file monitoring

Re: Using fschange to monitor Windows filesystem

fschange file monitoring

fschange pollPeriod parameter

fschange generates false update events

Re: Monitoring changes to configuration files

Re: Monitoring changes to configuration files

Re: Monitoring changes to configuration files

Monitoring changes to configuration files

Re: Same fields with different values in one event

Same fields with different values in one event

Additional field - event acknowledgment