Alerting

How to monitor and alert on any success or failure of a su to root on my *nix systems?

bgamblin
Explorer

How do I monitor and alert on any success or failure of a su to root on my *nix systems?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can (if not already) monitoring for sudo logs in your nix systems. I believe it should be available at /var/adm/sudo.log. Once the data is available in Splunk, you can use following to learn how to create alerts.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Alert/Aboutalerts
www.splunk.com/view/SP-CAAAGYG

0 Karma

lycollicott
Motivator

If you can query those events in search you can then create an alert on those.

In top right of window click "Save As" and select "Alert" from the drop down. It will walk you through it.

This could help if you haven't seen it yet.
http://docs.splunk.com/Documentation/Splunk/6.3.2/Alert/Aboutalerts

0 Karma

mihall
Path Finder

What would this search query look like?

0 Karma

lycollicott
Motivator

On CentOS the su failure is logged in /var/log/messages like this:

Jul 19 12:38:17 localhost su: FAILED SU (to root) non_root on pts/0

So something like this query:

index=whatever_your_index_is  "FAILED SU (to root) "
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...