Getting Data In

Unable to Collect SMBServer/Audit logs

CJHindmarsh
Explorer

I have been unable to get the universal forwarders to correctly collect the SMB Server audit logs. The inputs.conf file on the deployment server has the following stanza configured but there are no logs flowing in. The other events in the inputs file work without any issues. 


## Application and Services Logs - SMB Server Audit Log
[WinEventLog://Microsoft-Windows-SMBServer/Audit]
index = wineventlog
disabled = 0
start_from = oldest
current_only = 0

Thanks 

 

Labels (3)
0 Karma
1 Solution

CJHindmarsh
Explorer

Yep, the above stanza is correct. I was just impatient I think. The next morning I had pretty much all the logs available to search.

View solution in original post

0 Karma

adobrzeniecki
Path Finder

Is that the correct path of where those logs are actually located? Also, you are going to want to make sure that Splunk is able to capture from that location. Might want to check permissions on the windows event log configuration.

km1986
Path Finder

Hey, were you able to get this working?

0 Karma

CJHindmarsh
Explorer

Yep, the above stanza is correct. I was just impatient I think. The next morning I had pretty much all the logs available to search.

0 Karma

adobrzeniecki
Path Finder

What sourcetype did your data come in with? Did you have to create the sourcetype?

CJHindmarsh
Explorer

I was at the time utilizing the Splunk add on for Windows. It came with some predefined sourcetypes for Win Event logs.

0 Karma

km1986
Path Finder

I was able to fix it. It was permissions on Windows Event Logs. Used https://support.umbrella.com/hc/en-us/articles/115004063808-Using-wevtutil-to-check-Event-Log-permis... as reference to correct the channel access string for Microsoft-Windows-SMBServer/Audit. Thanks for the suggestion.

km1986
Path Finder

Was splunkd running as SYSTEM or as a domain account? I tried both, restarted Splunk services and the DS, but while other Event IDs are coming as expected the Event ID 3000 (SMBServer Audit) logs are not coming in. Now that it is certain the path is correct, I'm thinking if it something related to permissions.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...