How to monitor and alert on the status of services on a forwarder and when an External USB device is connected?

[deepthi5]

Hi,

I have 10 machines running a splunk forwarder now and I want to know the status of services on these machines.

For example, I have an Antivirus service running on ten machines. Whenever this service is stopped, I should get an alert, and when the service is started again, then I should get another alert.

Another example for the same 10 machines, if anyone connects an external USB device, I should get an alert and the details of this USB device connected, and another alert when it is disconnected.

Thanks and Regaards,
Deepthi

[sandeepvalapi]

Hi Deepthi,

I have to setup something similar like your requirement. I got to monitor all windows services and send out an alert. If you were successful in configuring USB device, can you please let me know the steps.

Thanks,
Sandeep

[MuS]

Hi deepthi5,

This is more an OS then Splunk related question. You must first figure out how those 10 OS's report process status and USB connects. If you're using any unix/linux OS try the Splunk Unix App https://splunkbase.splunk.com/app/273/ and search your processes and USB events in index=os. Read more about the app here http://docs.splunk.com/Documentation/UnixApp/5.0.2/User/Whatdataarecollected

For Windows there is an app as well https://splunkbase.splunk.com/app/1680/ , but I'm not sure how or if your will be able to get the USB events (WMI maybe?)

Hope this helps to get you started ...

cheers, MuS