Getting Data In

Force Re-Enumeration of all AD objects with ADmon?

Jason
Motivator

From my understanding, ADmon will pull down all objects in AD on first run, then only report changes from then on. However, the original baseline data will get lost when it ages out of an index.

Is there a way to force ADmon to re-enumerate all AD objects to get a proper baseline, occasionally?

1 Solution

rgopalan
Splunk Employee
Splunk Employee

You could do one of the following to re-sync the events from the server.

i) Manually add another stanza in etc\...\local\admon.conf like so:

[newCollection]
targetDc = "your Server here"
startingNode = 
monitorSubtree = 1
disabled = 0

ii) Use Splunkweb to add the new collection with the same settings as the old one.

iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon there is a file called "your collection name here.ini". Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate.

View solution in original post

rgopalan
Splunk Employee
Splunk Employee

You could do one of the following to re-sync the events from the server.

i) Manually add another stanza in etc\...\local\admon.conf like so:

[newCollection]
targetDc = "your Server here"
startingNode = 
monitorSubtree = 1
disabled = 0

ii) Use Splunkweb to add the new collection with the same settings as the old one.

iii) In the splunk directory, under var\lib\splunk\persistentstorage\ADMon there is a file called "your collection name here.ini". Deleting this file before restarting splunk-admon.exe will resync the data from the server. If there are multiple such files, pick the file pertaining to the collection you want to reenumerate.

helge
Builder

Should it not be "inputs.conf" instead of "admon.conf"?

0 Karma

maraman_splunk
Splunk Employee
Splunk Employee

Yes

method 1 worked for me :
modify input app deployed on UF locally on AD :
in inputs.conf
change the admon collection name [admon:collection2]
used baseline=1
disabled=0
targetDC = "myAD"
index=myindex
monitorSubtree=1

push to uf
then wait for baseline to complete
then change baseline to 0 and repush to uf

This way is easier when you don't have local access on the AD to clean up files

0 Karma

helge
Builder

Deleting the INI files is the way to go!

0 Karma

Jason
Motivator

I have not been able to test this, but am going to mark this as accepted. If anyone is able to test this, please comment!

0 Karma

Jason
Motivator

(Without completely clearing fishbucket.)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...