Hi,
We are trying to set up the Linux Auditd App on one of our Search Heads. Currently, there are two Indexers getting Auditd related data and both have linux-auditd and TA_linux-auditd Apps installed. App's have been configured to correctly Index the Audit data in the sourcetype needed, i.e. linux:audit.
Both Indexers have been added as a search peer and are connected to the Search Head. When we use the Linux Audit App on the Search Head, it is only able to see data from first indexer.
SH itself can see both Indexes properly and this was verified using a generic search for sourcetype=linux:audit
.
But when we check the auditd_indices, upon which the App relies, it only sees the Index from first indexer.
so, on the Search Head,
sourcetype=linux:audit | top index
will list both Indexes
But | inputlookup auditd_indicies
will only list one.
On the Search Head, apart from linux-auditd and TA_linux-auditd we also have SA-LinuxAuditd installed to help with correlation. Are there any additional steps involved to make sure auditd can look at all indexes?
When we do the search for auditd_indices locally on the Indexers, the one having issues only reports back a "*" instead of the Index name. The first Indexer correctly lists the underlying Index for the same search.
Thanks,
~ Abhi
This has been resolved.
App needs to be configured before it can identify the correct Index. This can be done using the last tab on the App's dashboard called "Configure".
This has been resolved.
App needs to be configured before it can identify the correct Index. This can be done using the last tab on the App's dashboard called "Configure".