Hello,
I have all my Splunk Universal Forwarders on Windows 2008 R2 machines that are generating this error:
ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::processLogChannel: Failed to checkpoint for channel='security'
The only modification that I have made is to the inputs.conf file adding:
[WinEventLog://Security]
disabled = 0
whitelist = 4624,4625,4634,4656,4659,4660
Any suggestion?
Regards
Danilo Massa
Filtering of Windows Event using whitelist = << list >> or blacklist = << list >>, does work on Universal Forwarder in 6.x. Also, in my environment using stanza like below does not cause the warning.
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf [WinEventLog://Security]
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf blacklist = 5156
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf checkpointInterval = 5
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf current_only = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf disabled = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dc_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dns_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_resolve_ad_obj = 1
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf start_from = oldest
"...seems that filtering in not supported on Universal Forwarder"
It's only supported for Windows EventLogs as described in the input.conf documentation:
Filtering in input.conf on the indexer wouldn't make any sense. You could only filter the Windows EventLogs on the indexer. It works for UF.
# Windows Event Log Monitor
blacklist = << list >>
whitelist = << list >>
From http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Typesofforwarders#Forwarder_comparison seems that filtering in not supported on Universal Forwarder ...
"...I have found that changing inputs.conf on a Universal Forwarder is not an option on Splunk 6.0.2."
Is this a known bug?
According to the documentation it's still valid
http://docs.splunk.com/Documentation/Splunk/6.0.2/admin/inputsconf
And here is a blog from Adrian Hall
http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/
"I included two techniques – firstly, filtering by event code so that you didn’t include the events you didn’t want; and secondly, filtering the explanatory text on the end of each event."
"Let’s say you don’t want firewall events. From the previous blog post, event ID 5156 and 5157 detail the firewall connection accept and deny messages. Let’s say those are not relevant to us. Previously, we had to add a props.conf stanza to initiate a filtering action that was done in transforms.conf – it was complicated. In Splunk 6, everything is done in inputs.conf."
Sorry ... my fault I have found that changing inputs.conf on a Universal Forwarder is not an option on Splunk 6.0.2.
So I have put this filter on the props/transforms on the index server.
Regards
Danilo
Hello,
same here.
I'm using the blacklist option instead.
Regards
Andreas