Splunk Search

snare running windows sending data to linux splunk server

mritorto
New Member

guys

I want to capture the windows event logs running on my windows servers from a linux server running linux.

Can it be done with snare?

marc

Tags (1)
0 Karma

MikeyG
Explorer

If your interested in the standard set of Event Logs/Active Directory/DNS/DHCP logs, then absolutely and it works well on everything up to and including Windows 2008R2. However, if you need to get any WMI data out of the servers, then consider using the splunk light weight forwarder and read the doc's on how to implement.

In my environment Windows Snare clients send tcp to a syslog-ng server on the same RHEL Linux box as Splunk resides. syslog-ng sends to Splunk and is the records manager for log retention. Snare client can be deployed via .exe or by .msi & group policy or via a third party tool like LANDesk. Need to make sure your Group Policy Auditing is tight and need to tweak the out of the box Snare objectives to get the detail you want. One advantage from my point of view is that logs from Snare are a single line syslog format and comingles well with CISCO data that I also retrieve/index.

mritorto
New Member

I got it work with sname for the event logs.

How do I do dhcp or any other application logs

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...