Getting Data In

WinEventMon::processLogChannel unable to checkpoint

danilom
Explorer

Hello,
I have all my Splunk Universal Forwarders on Windows 2008 R2 machines that are generating this error:

ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::processLogChannel: Failed to checkpoint for channel='security'

The only modification that I have made is to the inputs.conf file adding:

[WinEventLog://Security]
disabled = 0
whitelist = 4624,4625,4634,4656,4659,4660

Any suggestion?

Regards
Danilo Massa

rbal_splunk
Splunk Employee
Splunk Employee

Filtering of Windows Event using whitelist = << list >> or blacklist = << list >>, does work on Universal Forwarder in 6.x. Also, in my environment using stanza like below does not cause the warning.

...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf [WinEventLog://Security]
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf blacklist = 5156
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf checkpointInterval = 5
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf current_only = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf disabled = 0
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dc_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_dns_name =
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf evt_resolve_ad_obj = 1
...\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\default\inputs.conf start_from = oldest

andreasz
Path Finder

"...seems that filtering in not supported on Universal Forwarder"

It's only supported for Windows EventLogs as described in the input.conf documentation:
Filtering in input.conf on the indexer wouldn't make any sense. You could only filter the Windows EventLogs on the indexer. It works for UF.

# Windows Event Log Monitor

blacklist = << list >>

  • Tells Splunk which event IDs and/or event ID ranges that incoming events must NOT have in order to be indexed.
  • Optional. This parameter can be left empty.
  • A comma separated list of event ID and event ID ranges to exclude (example: 4,5,7,100-200).
  • If no value is present, then there is no effect.
  • If you specify both the "whitelist" and "blacklist" attributes, the input ignores the "blacklist" attribute.

whitelist = << list >>

  • Tells Splunk which event IDs and/or event ID ranges that incoming events must have in order to be indexed.
  • Optional. This parameter can be left empty.
  • A comma-separated list of event ID and event ID ranges to include (example: 4,5,7,100-200).
  • If no value is present, defaults to include all event IDs.
  • If you specify both the "whitelist" and "blacklist" attributes, the input ignores the "blacklist" attribute.

danilom
Explorer

From http://docs.splunk.com/Documentation/Splunk/6.0.2/Forwarding/Typesofforwarders#Forwarder_comparison seems that filtering in not supported on Universal Forwarder ...

0 Karma

andreasz
Path Finder

"...I have found that changing inputs.conf on a Universal Forwarder is not an option on Splunk 6.0.2."

Is this a known bug?
According to the documentation it's still valid

http://docs.splunk.com/Documentation/Splunk/6.0.2/admin/inputsconf

And here is a blog from Adrian Hall

http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/

"I included two techniques – firstly, filtering by event code so that you didn’t include the events you didn’t want; and secondly, filtering the explanatory text on the end of each event."
"Let’s say you don’t want firewall events. From the previous blog post, event ID 5156 and 5157 detail the firewall connection accept and deny messages. Let’s say those are not relevant to us. Previously, we had to add a props.conf stanza to initiate a filtering action that was done in transforms.conf – it was complicated. In Splunk 6, everything is done in inputs.conf."

0 Karma

danilom
Explorer

Sorry ... my fault I have found that changing inputs.conf on a Universal Forwarder is not an option on Splunk 6.0.2.
So I have put this filter on the props/transforms on the index server.

Regards
Danilo

0 Karma

andreasz
Path Finder

Hello,

same here.

I'm using the blacklist option instead.

Regards

Andreas

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...