- Splunk Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: UNIX last event /var/log/wtmp
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
My UNIX (Solaris) host installed Splunk universal forwarder in which some kind of monitor in inputs.conf is successful indexed.
But I would like to retrieve daily login information for the UNIX servers without luck to retrieve the events from last command.
Could anyone here help for the UNIX login info. to br indexed to Splunk?
Thanks
Rossi
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By "without luck" are you referring to your attempts to index the wtmp file data?
Splunk for Unix and Linux does have inputs and the necessary script to input this data.
http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux is for splunk servers and
http://splunk-base.splunk.com/apps/33800/splunk-for-unix-and-linux-technology-add-on if you prefer for your Universal Forwarders (if applicable).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in UNIX app, there has script to retrieve the last from various OS include IBM AIX, SUN Solaris, Linux different distribution... Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, other kind of data are already sent to Splunk instance and could be searched & reporting.
And I tried to use "script input" which using "last" command is not success, due to formatting as below stated.
http://splunk-base.splunk.com/answers/5844/can-i-splunk-my-wtmp-files
"This can be more elaborate since "last" doesn't have tailing or time span selection capabilities, but advanced shell scripting and cron can be used to set this up."
[Script Input]
"/usr/bin/last -f /opt/logs/acctlog/wtmpx.20111114"
where wtmpx.$DATE$ is the last date "/var/adm/wtmpx" truncated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By "without luck" are you referring to your attempts to index the wtmp file data?
Splunk for Unix and Linux does have inputs and the necessary script to input this data.
http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux is for splunk servers and
http://splunk-base.splunk.com/apps/33800/splunk-for-unix-and-linux-technology-add-on if you prefer for your Universal Forwarders (if applicable).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let's check how these apps could be help in this items. Get back here after check, thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Do you have log data being monitored already? (Is that what you mean by monitor in inputs?) and do you just want to understand how to search the data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk is able to monitor secure log on unix. Is the following setting meet your requirement?
configure inputs.conf like as bellow:
[monitor://var/log/secure*]
sourcetype = *******
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Those UNIX servers do not have any file named /var/log/secure*
Archived Metrics Now Available for APAC and EMEA realms
Detecting Remote Code Executions With the Splunk Threat Research Team
Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!
