How to filter off winevent code to capture only failure audit status?

Question

Hi,

How can I filter out "type=Success Audit" logs off a windows event and log only the failure logs?

Currently I have this in transform.conf:
[setnull]
REGEX = (?m)^EventCode = 673
DEST_KEY = queue
FORMAT = nullQueue

It is filtering off all of 673 but now I will like to capture the failure logs of 673 but not the success logs.

Am just wondering if something like this can be done?
REGEX = (?m)^(EventCode = 673)(type = "Success Audit")

Thanks

Accepted Answer

I think something like this will work for you:

REGEX = [\r\n]+EventCode=673[\r\n]+.*?[\r\n]+Type=Success Audit[\r\n]

I would recommend reading up on regex syntax here:

http://www.regular-expressions.info/

On second glance, I'm not sure that your given example stanza should work the way you want it too. If you have a regex that's matching EventCode=673, then only those events would be sent to the null queue and everything else would be indexed as normal. So you really need a regex that matches everything but event code 673. Then to meet your full requirements (filtering out the success messages), you would want a regex that filters out everything but failure 673 events. Another approach is to use two transformers, the first one routes all events to the nullQueue, and the second only matches your 673 failure messages and then sets the queue to indexQueue

You may find some more helpful examples on how to do this here:

http://answers.splunk.com/questions/4816/winevent-filtering-on-heavy-forwarder

Accepted Answer

0	Hi, Thanks for the suggestions. This is working for us by capturing eventcode 578 AND Type=Audit Success : `REGEX = (?msi)^EventCode=578.^(Type=Audit Success)` link answered 19 Oct '10, 03:25* remy06 297●6●4●45 accept rate: 40%

Answer 3

0

Hi,

If two transformers are used, the first one routes all events to nullQueue, which we will not be able to capture any other events then??

Your REGEX seems to be working fine and thanks for the link.

link

answered 10 Aug '10, 03:39

remy06
297●6●4●45
accept rate: 40%

edited 10 Aug '10, 08:45

Answer 4

I got it mistaken.It doesn't seem to be working.. Using the REGEX I've tried to filter off based on User instead:
REGEX = [\r\n]+EventCode=673[\r\n]+.*?[\r\n]+User=SYSTEM[\r\n]
But it doesn't work.

Here is a sample of Windows event:
08/05/10 05:39:03 PM
LogName=Security
SourceName=Security
EventCode=673
EventType=8
Type=Success Audit
ComputerName=ServerA
User=SYSTEM
..
..
..
CategoryString=Account Logon
..
Message=Service Ticket Request:

User Name:      ServerA.com

User Domain:        ServerA.com

Service Name:       ServerA$

..  
    ..  

Failure Code:       -  

...  

Transited Services: -

Answer 5

0	I did it like that: `[wminull] REGEX = (?msi)^(EventCode=697\|Type=Audit Success) DEST_KEY = queue FORMAT = nullQueue` So it simply filters EventCode=697 OR Type=Audit Success to the null queue link answered 31 Aug '10, 12:16 Daniel 11●2 accept rate: 50%

Answer 6

0

I had to set something up like this. They wanted a list of the top 20 failed login by userid.

I set the following up as an event type: index="prod_dc_event_logs" sourcetype="security" Type="Failure Audit" EventCode="538" OR EventCode="540" OR EventCode="680"

Then I set the following search up: eventtype="WINTEL_FailedLogin" | chart count by Logon_account | sort 20 - count

Brian

link

answered 31 Aug '10, 12:20

Brian Osburn
191●1●2●21
accept rate: 23%

How to filter off winevent code to capture only failure audit status?

Follow this question

Splunk Resources

Related questions