About bgstein

bgstein · ‎10-12-2020

Yes - that was indeed what was needed. It didn't seem to work initially - after restarting the Splunk server and after restarting the Splunk UF agent on the client. But checking back a day later it was correctly parsing. Most likely I was impatient. Thank you.

bgstein · ‎10-09-2020

the debug info shows the file being monitored without errors. closer check within the splunk console and parsing the log source shows the logs 01-10-20 getting inserted with the Jan 01 logs. So having never verifed that these logs were getting parsed correctly in the first place I now see that I've got a mess.

bgstein · ‎10-09-2020

That didn't work... Moving on to seeing what setting DEBUG in log.cfg shows: category.TailingProcessor=INFO category.WatchedFile=INFO category.ArchiveProcessor=INFO category.TailReader=INFO

bgstein · ‎10-09-2020

I have two monitored logs for which no new events are being collected. The Splunk logs don't show any (new) issues or errors - although I did spend quite some time trying to understand if the encoding is the problem. Seing many: "Using charset UTF-16LE, as the monitor is believed over the raw text which may be UTF-8". But these appear for logs that are working and logs that are not. More digging shows the logs stopped being collected *exactly* after midnight. The first two were collected and the second two were not. [I 06/00000040/T06BC/P0AA0] 30-09-20 23:47:13 - Client Rules: rule 'Internal Access Policy' matched. [I 06/0000000A/T06BC/P0AA0] 30-09-20 23:47:13 -Server RAS-SH3:3389 is available [I 0E/00000000/T1920/P0AA0] 01-10-20 00:15:28 - Session login for userwas successful. [I 06/00000040/T1920/P0AA0] 01-10-20 00:15:28 - Client Rules: rule 'External Copy and Paste and Printer I'm guessing I'll need to use the props.conf to set the TIME_FORMAT for these particular files in the app that is collecting them. I've not had to dig this deep into Splunk props before. Wishing myself luck...

bgstein · ‎09-14-2020

The above was super helpful and would have been even more helpful if I'd see it earlier. I'd like to suggest or encourage you link this to the details page in splunkbase: eg: https://splunkbase.splunk.com/app/833/#/details Also would you address the question of - what if my organization isn't and doesn't expect to use Splunk Cloud. I see the latest versions of SAI are cloud only. Makes me worried about using it - will it have a future for me. Also not clear if I do want to use it should I use (as of Sept 2020) version 2.0.4 or 2.1.0 (as 2.1.1 says only cloud) and latest 2.2.0 is only cloud.

bgstein · ‎11-06-2018

This was super helpful. Thank you for taking the time to write it up. Two additions to what you've written to be aware of: First: ./splunk enable boot-start places a file in LaunchAgents - people may want the file in LaunchDaemons. http://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/ConfigureSplunktostartatboottime#Enable_boot-start_on_MacOS Second: Splunk has a way to seed the client password: https://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/User-seedconf

bgstein · ‎09-28-2018

Worked for me and gave me just what I wanted. Thanks! Albeit for a simpler search.

bgstein · ‎07-25-2018

I'd appreciate your taking the time. To document the problem, the app uses a powershell script to pull information from Veeam. Veeam provides a powershell snapin VeeamPSSnapin. The script creates csv files that are picked up by the splunk forwarder. The app also tried to create a scheduled task to run the powershell script. On my box I had to manually create the task. First question I'm working on is how often should the task run? I modified the script to set date1 as follows and run the script currently daily: $date1 = (Get-Date).AddDays(-1) Second issue I had was the script not connecting, so I added before the get queries: Connect-VBRServer Current problem I have is with the line starting: Get-VBRJob -Name * | Select @{N="#Date";E={$_.FindLastSession().Progress.StartTime}} This is returning no value which throws a bunch of stuff off. I've set it to date2 and am now trying to understand enough to figure out why the original code doesn't work. The duplicate data you mention is I think from the line creating JOBTSK with Get-VBRBackupSession.

bgstein · ‎07-24-2018

Would you be willing to post you modifications or recommendations?

bgstein · ‎07-12-2018

One other rabbit hole I went down to get audit log data is using auditreduce + praudit Again this works - audit data goes to splunk - but produces mostly noise. It checks a compliance box without being particularly useful. I'll check out xnumon. Thanks.

bgstein · ‎07-06-2018

One possibility is to use osquery to pull the data from asl and put it into a file monitored by the splunk forwarder. And of course osquery exposes lots of other stuff you could grab too. https://medium.com/@clong/osquery-for-security-b66fffdf2daf https://blog.kolide.com/monitoring-macos-hosts-with-osquery-ba5dcc83122d This works - the part I'm struggling with is figuring out what to grab. Working with the log command in Sierra lets you play with the logged data but I don't see any guidance or recommendations on what to grab to meet standard audit requirements. If you can grab everything great - but if you are concerned about license capacity then most of the stuff going to asl looks like noise and should be filtered at the host.

bgstein · ‎07-03-2018

10.13 is now listed. not sure when it was added.

bgstein · ‎12-15-2017

SERVICESTARTTYPE=manual doesn't seem to work with the x64 forwarder msi 6.6.4 or 7.0.1 on Windows 10. From the msiexec log: MSI (s) (88:F0) [09:41:47:549]: Command Line: RECEIVING_INDEXER=10.2.1.100:9997 WINEVENTLOG_SEC_ENABLE=1 SERVICESTARTTYPE=manual LAUNCHSPLUNK=0 AGREETOLICENSE=Yes CURRENTDIRECTORY=C:\WINDOWS\system32 CLIENTUILEVEL=3 CLIENTPROCESSID=3900 but InstallSplunkService: Info: Execute string: cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" cmd splunkd install --startup=auto >> "C:\Users\xxx\AppData\Local\Temp\splunk.log" 2>&1"

bgstein · ‎05-05-2017

Looks like I need to learn to read: http://docs.splunk.com/Documentation/Splunk/6.6.0/Installation/Aboutupgradingto6.6READTHISFIRST Connectivity over SSL between version 6.6 and versions less than 5.0 is disabled by default Because of changes to the security ciphers in version 6.6 of Splunk Enterprise, instances of Splunk software that run on version 5.0 or less cannot connect to instances of version 6.6 or greater by default. When you upgrade, any instances that run version 5.0 or less will no longer communicate with the upgraded instance over SSL. To work around the problem, edit inputs.conf and outputs.conf on the sending instances to enable ciphers that allow communication between the instances.

bgstein · ‎05-05-2017

We are newly working as a Splunk license Slave of a Master run by another department at our University. Our update of the Slave from 6.5.3 to 6.6.0 broke the SSL communication: 05-05-2017 12:07:38.980 -0700 ERROR LMTracker - failed to send rows, reason='Unable to connect to license master=https://splunk-license.xyz.edu:8089 Error connecting: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure' 05-05-2017 12:08:39.973 -0700 WARN SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read server hello A', alert_description='handshake failure'. This makes me sad. Any suggestions for how to get our Master to accept us again?

bgstein · ‎04-14-2017

I share your pain... Did you make progress with this? There is an old document that doesn't seem to work for current versions of Mac OS X: https://wiki.splunk.com/Community:HowTo_Configure_Mac_OS_X_Syslog_To_Forward_Data

bgstein · ‎07-15-2015

It may be that the spaces are required - meaning that domain_name=SQLSERVER doesn't pass but domain_name = SQLSERVER will send domain=SQLSERVER.

bgstein · ‎11-07-2013

Thanks, that allows me to continue. It is a shame that you can't manage the size of the spool directory as you can the indexes.

bgstein · ‎11-06-2013

Among other struggles with DB Connect I'm trying to pull a large amount of historical data into Splunk to see it is possible to migrate a mysql database into Splunk and running into issues with files in dbmon filling the system drive. This is with Splunk (free) running on Windows 2008 R2. Is it possible to move the dbmon spool via a change to the configuration file? Is there a way to cleanly delete *.dbmonevt files? Thanks

Posts	19
Solutions	1
Karma Given	12
Karma Received	6
Member Since	‎04-29-2011

Online Status	Offline
Date Last Visited	‎10-12-2020 07:44 PM

Log Monitor Stops from 30-09-2020 to 01-10-2020

How to fix broken Slave to Master SSL Connection a...

disk filling with spool dbmon dbmonevt files

Re: Log Monitor Stops from 30-09-2020 to 01-10-202...

Re: Log Monitor Stops from 30-09-2020 to 01-10-202...

Re: Log Monitor Stops from 30-09-2020 to 01-10-202...

Log Monitor Stops from 30-09-2020 to 01-10-2020

Re: What's the best practice for collecting UNIX O...

Re: How to do a mass deployment and configuration ...

Re: Days in Alphabetical Order but need to be in d...

Re: Veeam Backup TA

Re: Veeam Backup TA

Re: Mac OS X Sierra - How to get all logs from th...

Re: Mac OS X Sierra - How to get all logs from th...

Re: Universal Forwarder Support for Mac OSX 10.13?

Re: How to disable Windows universal forwarder ser...

Re: How to fix broken Slave to Master SSL Connecti...

How to fix broken Slave to Master SSL Connection a...

Re: Mac OS client logs into splunk

Re: How to connect Splunk DB Connect 2.x to MS SQL...

Re: disk filling with spool dbmon dbmonevt files

disk filling with spool dbmon dbmonevt files