I have been unable to get the universal forwarders to correctly collect the SMB Server audit logs. The inputs.conf file on the deployment server has the following stanza configured but there are no logs flowing in. The other events in the inputs file work without any issues.
## Application and Services Logs - SMB Server Audit Log
index = wineventlog
disabled = 0
start_from = oldest
current_only = 0
Is that the correct path of where those logs are actually located? Also, you are going to want to make sure that Splunk is able to capture from that location. Might want to check permissions on the windows event log configuration.
I was able to fix it. It was permissions on Windows Event Logs. Used https://support.umbrella.com/hc/en-us/articles/115004063808-Using-wevtutil-to-check-Event-Log-permis... as reference to correct the channel access string for Microsoft-Windows-SMBServer/Audit. Thanks for the suggestion.
Was splunkd running as SYSTEM or as a domain account? I tried both, restarted Splunk services and the DS, but while other Event IDs are coming as expected the Event ID 3000 (SMBServer Audit) logs are not coming in. Now that it is certain the path is correct, I'm thinking if it something related to permissions.