Deployment Architecture

auditd splunkd

criscollins
New Member

We are required to monitor /var/log/audit. Whenever splunkd accesses audit.log a new event is created. We are getting close to ten thousand of these messages per hour. I have tried to create an excpetion in audit.rules, however there does not seem to be a good hook, that won't affect legitimate audit.log access events. Any ideas how to solve this issue?

Tags (2)
0 Karma

tmacdonagh
Engager

Removed my previous bad answer. The proper line to be entered into your audit.rules file is

-a exit,never -F path=/opt/splunkforwarder/bin/splunkd -k splunk_exclude

responsys_cm
Builder

Are these messages being generated from syscall rules or file system rules? If you are using a syscall rule, you can use the -F switch and exclude the uid of the Splunk user.

The other option is to just have Splunk route those events to the nullQueue.

Craig

0 Karma

tmacdonagh
Engager

splunk runs as root.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...