|
I want to gather and index the security eventtlogs on a remote Windows server. While trying to add a new Windows Eventlog collection input within Splunk, I am getting the following error: Failed to fetch data:[HTTP 500] Splunkd internal error;[{'text':"In handler 'win-wmi-enum-eventlogs': Error accessing MWI-0x7ff8fffb - Access is denied.. Make sure WMI is configured correctly.",'code':None, 'type': 'ERROR'}] FYI, the user account that Splunk is running as also exists on the remote Windows machine and has full rights to administer both servers. |
|
The error is, alas, precise - we have attempted, and been explicitly denied, access to the logs. This can happen for the following reasons :
Whew. That's a lot of reasons, and there can be even more edge cases. For testing, try a domain admin account for the splunkd service login to verify connectivity is possible, then go from there to improve security. See: http://www.splunk.com/base/Documentation/latest/Admin/MonitorWMIdata or http://msdn.microsoft.com/en-us/library/aa394603%28VS.85%29.aspx RE: Domains. If you are NOT in a domain, it is possible to have identically named accounts with exactly the same login name and password who are both Local Administrators on both machines work with WMI. The polling Splunkd needs to have this account as it's service login. Note this will NOT work if either machine is actually in a domain; both must be stand alone. |
