About ClausBom

ClausBom · ‎08-30-2023

So, answer from Splunk Support: You should not remove file libcrypto.so.1.0.0, it is part of libraries. This file exists in fresh new 9.1.0.2 Splunk installation too, so it is not part of old upgrade. Splunk version 9.1.0.2 uses OpenSSL 1.0.2zg. Topic about CVE-2023-3446 vulnerability was send to developer team. In the meantime, Tennable apparently found out, that they'd been a bit premature... OpenSSL disappeared from their scannings... 🙄😤

ClausBom · ‎08-25-2023

Well... if it wasn't for this line, in that advisory: OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. I guess I could tell them to focus on real problems... But Nessus complaints about $HOME/lib/libcrypto.so.1.0.0 in both Enterprise and Universal Forwarder - so they might have a right to obsess? Splunk might not use this old stuff - but why isn't it removed then?

ClausBom · ‎08-24-2023

I've raised a support ticket on this as well. I'll keep you updated on the outcome - if any 🤔

ClausBom · ‎08-22-2023

I'm getting punked for this from our Vuln.mgt team too. They refer to a " CVE-2023-3446 - OpenSSL 1.0.2 < 1.0.2zi Vulnerability". Apparently, there's a file '/opt/splunk/lib/libcrypto.so.1.0.0' that existed for years, that all of a sudden is a problem to Nessus - but I can't find anything about it from Splunk? I just tried to do an upgrade all the way from 6.5.2 to 9.1.0.2, but nothing changes - except the timestamp on the file.

ClausBom · ‎12-01-2020

Hi Lukas, Thanks, that just verifies the result I came to myself. I have a support ticket running on the issue, hope that it will shed some light on it for the future 🤞 Regards Claus

ClausBom · ‎11-30-2020

Hi Lukas, Did you get any closer to a solution for this? we seem to be facing the same problem 😖 Cheers Claus

ClausBom · ‎01-04-2016

Hi, after upgrading from 6.1.1 to 6.3.1, we see the same problem. Search head is reporting ALL forwarders as IP, in the 'Splunk Alert: DM missing forwarders'-notification, as well in Forwarder overview in the Deployment Monitor - along with actual missing forwarders, being reported with FQDN. Is the above mention workaround still the solution, or should the problem have been fixed? I tried to search for DEPMON-142 in the documentation site, but nothing seems to be found 😞 Regards Claus

ClausBom · ‎02-19-2015

Hi guys, In order to comply with auditor demands, we need to send the audit.log files from (Linux-based) indexers and search heads to an external system (not Splunk). Is there any way, we can get Splunk itself to send these files to e.g. syslog, or do we have to find another way to do it? I have read http://docs.splunk.com/Documentation/Splunk/6.0.1/Forwarding/Forwarddatatothird-partysystemsd and http://answers.splunk.com/answers/116701/how-to-send-audit-and-splunkd-logs-of-splunk-instance-to-external-syslog-server.html but still not found the silver bullet 😕 Regards Claus

Posts	8
Solutions	0
Karma Given	14
Karma Received	1
Member Since	‎04-17-2013

Online Status	Offline
Date Last Visited	‎12-05-2025 12:07 AM

How to send audit.log to external system?

Re: Why is OPENSSL vulnerability still showing in ...

Re: Why is OPENSSL vulnerability still showing in ...

Re: Why is OPENSSL vulnerability still showing in ...

Re: Why is OPENSSL vulnerability still showing in ...

Re: Forward Splunk audit log to external syslog se...

Re: Forward Splunk audit log to external syslog se...

Re: After Update to Splunk Enterprise 6.2, why doe...

How to send audit.log to external system?

Join the Conversation