Monitoring Splunk

Linux input for process monitoring (similar to Windows Sysmon)

ejwade
Contributor

We're looking for a tool that does the same thing as Windows Sysmon (Sysinternals), but for Linux. The problem with ps and other process monitoring inputs in the Linux TA is the interval. If a process launches and closely quickly, an interval capture will missed it. We need something that will write a log whenever a process is created, preferably with the command launching the process.

Any input is appreciated.

0 Karma
1 Solution

larchinal75
Explorer

Good afternoon,

I did some brief research and testing with Linux systems for the same reasons; We were looking for command-line capture and process execution within our Linux environment. The best we came up with is Auditd. This provided close to the same results as Sysmon (i.e. if someone ran a command in command-line). The way it operates though is different to Sysmon where when you configured Sysmon and installed it, it began logging right away. With Auditd we had to create "rules" to look for activity.

I hope this answers your question.

Have a wonderful day!

View solution in original post

larchinal75
Explorer

Good afternoon,

I did some brief research and testing with Linux systems for the same reasons; We were looking for command-line capture and process execution within our Linux environment. The best we came up with is Auditd. This provided close to the same results as Sysmon (i.e. if someone ran a command in command-line). The way it operates though is different to Sysmon where when you configured Sysmon and installed it, it began logging right away. With Auditd we had to create "rules" to look for activity.

I hope this answers your question.

Have a wonderful day!

larchinal75
Explorer

harsmarvania57
SplunkTrust
SplunkTrust

You can achieve this using Linux auditd, please check with your Linux system administrator to configure auditd on Linux server and then monitor auditd.log file in Splunk.

ejwade
Contributor

@harsmarvania57 That's good advice. We've been exploring auditd; specifically EXEVCE system calls. Thanks for the suggestion!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...