Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Intermediate
Intermediate
Path Finder
Member since:
10-17-2017
06-18-2020
Community Statistics
| Posts | 27 |
| Solutions | 2 |
| Karma Given | 27 |
| Karma Received | 8 |
| Member Since | 10-17-2017 |
Activity Feed
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 10-15-2021 06:58 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 12-01-2020 09:58 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 12-01-2020 09:58 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 12-01-2020 09:57 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 11-24-2020 04:03 PM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-22-2020 09:18 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-22-2020 08:34 AM
- Got Karma for Re: Is there a yum/rpm repo for Splunk?. 09-22-2020 08:33 AM
- Karma Re: Can't get FQDN for /var/log/messages with Deployment Server and Linux T/A for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: Possible bad example in TA_netfilter documentation? for doksu. 06-05-2020 12:50 AM
- Karma Re: Linux Auditd app - Is the SPL for the Anomalous Event Volume panel broken? for doksu. 06-05-2020 12:50 AM
- Karma Re: Linux Auditd app - Is the SPL for the Anomalous Event Volume panel broken? for doksu. 06-05-2020 12:50 AM
- Karma Linux Auditd app - Is the SPL for the Anomalous Event Volume panel broken? for chris_barrett. 06-05-2020 12:50 AM
- Karma Re: Please cater for UFW in Auditd searches/reports for doksu. 06-05-2020 12:50 AM
- Karma Re: Feature Request: Track New SOFTWARE_UPDATE type (RPM audit events) for doksu. 06-05-2020 12:50 AM
- Karma Feature Request: Track New SOFTWARE_UPDATE type (RPM audit events) for alexgwilkinson. 06-05-2020 12:50 AM
- Karma Re: Does the Splunk Add-on for Squid Proxy work with current Squid versions? for chris_barrett. 06-05-2020 12:49 AM
- Karma Re: Synchronizing the passwd file between Splunk servers with a shared splunk.secret for dflodstrom. 06-05-2020 12:48 AM
- Karma Re: Why is the indexer discovery clear text password not being encrypted? for Lowell. 06-05-2020 12:47 AM
- Karma Re: Linux Auditd: What is the best way to make /var/log/audit/audit.log accessible to a non-root Splunk forwarder? for nsommars. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-09-2020
05:23 PM
It seems that the TTY and USER_TTY distinction is a Red-Hat distro thing and that Debian-based distros only use a filter key of TTY.
I think there may be another way of distinguishing between root and non-root keystrokes, but I'm not clear how we could apply this to both Red-Hat and Debian-based systems.
... View more
01-08-2020
07:06 PM
Hi Doug,
We've recently noticed that despite dutifully collecting TTY keypresses (using pam) that Debian/Ubuntu doesn't product USER_TTY audit events. The OSes seem to only produce TTY events, which are hex encoded.
(We're still trying to find why/how RHEL produces (encoded) TTY and (decoded) USER_TTY events for the same keypress log event.)
Would you be willing to change the way the "User TTY" feature works in your app please? Instead of being strictly "USER_TTY" ideally it would use the "TTY" filter key AND have Splunk decode the hex strings so they remain human-readable in the output of your app?
Thank you muchly!
EDIT: We're just researching the difference between USER_TTY and TTY filter keys in the audit log. It seems I may have misunderstood them and one is for non-root keystrokes, the other for root only. If you have any knowledge of Linux kernel auditing for keypresses, using pam_tty_audit.so please help me understand 🙂 Thanks!
... View more
05-16-2019
06:48 PM
@doksu it might be worth you putting your thoughts in this RH solution too: https://access.redhat.com/solutions/905243 as it's the same issue.
... View more
05-16-2019
06:46 PM
I agree this is a great idea for RHEL or CentOS - but the original poster doesn't say which Linux distro they are using.
I'm not convinced this solution would be ideal using a distribution which uses Apparmor (even though Apparmor profiles are simpler to write) because it doesn't provide the same level of confinement.
... View more
05-16-2019
06:35 PM
Do NOT do this on an Ubuntu (possibly Debian?) based system. auditd will fail to restart if the permissions of the audit log have been tampered with in any way.
On all Linux distros OS audit tools (like "ausearch") will complain if ACLs are added to the audit log.
As @nsommars points out it does not deal with log rotation.
I would suggest that @pbunts has the pragmatic solution, with @doksu's SELinux policy being the perfect but highly difficult option.
... View more
11-25-2018
07:54 PM
Well, feel free to post an answer here and I'll accept yours instead.
You did all the hard work after all!
... View more
11-20-2018
03:09 PM
@doksu quickly provided version 1.0.0 pre-release update of TA_netfilter which works. See other comments below.
... View more
11-20-2018
03:08 PM
Thanks @gjanders
... View more
11-20-2018
03:08 PM
Thanks @gjanders
... View more
11-18-2018
02:17 PM
For the record, for reasons I don't understand, Ubuntu has default rsyslog configuration which logs UFW events to /var/log/ufw.log AND allows these events to also be reported in /var/log/syslog and /var/log/kern.log
Fixing this is as simple as uncommenting '& stop' at the end of the block included in /etc/rsyslog.d/20-ufw.conf and reloading rsyslog.
... View more
11-18-2018
01:46 PM
Thanks for your help Doug, the updates you've made work.
Splunk Answers is being difficult and won't let me accept your answer!
Anyway, we ended up adding monitor stanzas for /var/log/ufw.log (ubuntu) and /var/log/firewalld (RHEL) to input.conf for *nix systems. We then added an explicit source stanza setting both log paths to sourcetype=syslog in props.conf and it's working reliably.
Thank you!
... View more
11-14-2018
09:07 PM
Thanks, we'd been logging to /var/log/firewalld OR /var/log/ufw.log and it seems those logs weren't being ingested with the 'syslog' sourcetype.
I think the addon is working, but it will take me a little while to confirm.
I've got an issue on Ubuntu where we're getting duplicate UFW logs. The same event appears in /var/log/syslog,/var/log/kern.log AND /var/log/ufw.log but I'll sort that out. Possibly syslog config.
... View more
11-14-2018
04:00 PM
Applying the TA to the indexer cluster didn't require a restart, but given this isn't working I've done a rolling restart anyway. No change.
... View more
11-11-2018
08:56 PM
@doksu Thanks for the fast response!
(I've removed some old responses I'd made here here which are irrelevant/confusing)
I'm sure that I've deployed 1.0.0 to an indexer cluster but I am not seeing events assigned the correct sourcetype. Could you please help me troubleshoot the problem?
Here's a sample:
Nov 14 09:59:01 examplesvr kernel: [ 573.578259] [UFW BLOCK] IN=ens160 OUT= MAC=00:50:56:80:e1:23:01:51:55:88:04:aa:08:01 SRC=10.10.19.23 DST=10.10.19.13 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=50776 DF PROTO=TCP SPT=51176 DPT=8080 WINDOW=29200 RES=0x00 SYN URGP=0
Thanks!
... View more
11-11-2018
06:51 PM
Hi Doug,
We use your excellent Auditd app and various TAs. It's geared for RHEL, which is understandable, but where applicable we use it with Ubuntu also.
For better or worse we are using "UFW" on Ubuntu. It appears practically impossible to permanently change the log prefix for built-in rules (we've spent considerable time investigating).
In the Linux Netfilter (iptables) Add-On documentation you say that we should add "ACTION=" with values ACCEPT, DROP or REJECT.
Could you please consider modifying your queries to also find "[UFW BLOCK]", "[UFW DROP]" or "[UFW REJECT]" so that it will just work with UFW? (I understand that UFW is the default on Ubuntu)
Thank you!
... View more
10-21-2018
02:56 PM
3 Karma
@amiracle I can't speak for @bishopolis but I expect most of us simply want Splunk to post public repos with Splunk software in RPM and DEB formats.
That way we can set up our automated mirrors/satellite to obtain the latest Splunk version and even patch Universal Forwarders without any human input.
Most other software we using in our Linux environment doesn't require us to manually log in and download updates every month (or so).
... View more
10-09-2018
03:05 PM
Thanks Doug that's helpful!
Please ignore my latest "answer" as I posted it before I'd seen your response.
... View more
10-09-2018
03:03 PM
A colleague offered a possible explanation. Is the intention in this example to determine the UID/GID of processes which have traffic blocked by outbound firewall rules?
... View more
10-08-2018
03:07 PM
The URL for the documentation was lost when I published my question. It is https://github.com/doksu/TA_netfilter/wiki
... View more
10-07-2018
08:46 PM
Hello,
We're configuring TA_netfilter based on the documention on github.
The documentation says:
It's recommended to log the uid and gid of the process that produces egress traffic using 'log-uid'.
For example:
-A OUTPUT -j LOG --log-prefix "ACTION=DROP " --log-uid
Perhaps this is just a bad example, but what's the point of logging the UID and GID on a drop message? Won't it always be UID=0 GID=0 for drops?! egress is only outbound traffic.
We are only logging dropped/rejected traffic, not success, so should we just skip this instruction?
Thanks!
... View more
08-01-2018
05:29 PM
So it turns out this was likely our problem. We actually did change the format of squid's logs, by enabling two directives for extra log detail:
1. strip_query_terms on (this is a business-use only network)
2. log_mime_hdrs on (we want detail)
Apparently the time since epoch field should be left as a part of the event and we suspect Splunk is correctly using it for the source time.
... View more
07-30-2018
10:12 PM
We're having problem with field extraction with this TA. We have not changed the format of squid's logs - it is all default.
We're running squid 3.5.20-12 on RHEL 7 which was compiled in October 2017. The TA was last updated in late 2015. What are the chances that the log format has changed but the TA hasn't been updated to match? Can someone please confirm that this TA works properly with a modern version of Squid?
Our problems include:
1. The time since epoch field being reported as a number ( not correctly as the time/date )
2. The User Agent field is not extracted properly
3. and any fields after User Agent are just appended to the user Agent field ( This includes /r/n characters )
Thanks!
... View more
07-09-2018
10:30 PM
1 Karma
Hello,
It's been another two months. Do you think this is likely to happen or is it just too hard internally?
... View more
05-06-2018
08:17 PM
2 Karma
amiracle could you please provide us all an update? Even if your work didn't go anywhere it would be helpful to have closure.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-18-2020
12:01 AM
|
Karma given to
