add monitor "Mountain Lion Security Logs"

[sterling_edmund]

How would you log the new Apple Security Logs in Mountain Lion 10.8. Thanks

[jbsplunk]

In 10.8, data is logged to asl(syslog) instead of secure.log, so it would be something like this:

./splunk add monitor /var/log/asl

[jbsplunk]

I just checked mine, and the data appears to be binary. So Splunk isn't going to read it. You could send NO_BINARY_CHECK to process the files using props.conf though.

[sterling_edmund]

0/s:key
118660/s:key
/var/log/asl/s:key
0.00/s:key
unreadable file type/s:key
/s:dict
/s:key

[sterling_edmund]

checking thanks

[jbsplunk]

From $SPLUNK_HOME/bin you can run 'splunk _internal call /services/admin/inputstatus/TailingProcessor:FileStatus > output' and then search output for the files in ASL, it'll tell you why they're ignored or if they've been read.

[sterling_edmund]

Still does not read the asl files - wip - thanks