Why is winEvent: DNS Server not getting across to Splunk Indexer for TA_Windows?

[monug8]

Currently, I am trying to extract the DNS logs from TA_Windows where inputs.conf file has [WinEventLog: //DNS Server) disabled=0 but still not working. I am trying to get DNS logs to index (microsoft_windows) ion indexer.

I have DNS server role installed on the machine. UF is also installed but still not working. I have seen many other blogs but not exactly pointing out the solution.

Any help will be appreciated.

Thanks

[monug8]

We have resolved DNS logs without using TA_Windows, but still I found it there are some issues with WinEventViewer for ADFS Trace logs. after enabling advanced logging on ADFS but still not getting ADFS Trace logs.

[scelikok]

Hi @monug8,

You don't need PowerShell or another issue if you can see DNS Server events inside Event Viewer. Maybe there is a mismatch between your Event channel name and input stanza. Could please share screenshot of your EventViewer showing your DNS Server events tree and your inputs.conf stanza?

[monug8]

@scelikok I did not get it when you said mismatch. Input.Confs is pretty standard provided by Splunk Addons for Windows:

Sorry Cannot provide DNS Events, it is also pretty standard DNs events.

Thanks

[monug8]

I am wondering if any powershell script run as part of [WinEventLog:// DNS Server] ?

if yes, then we have policy to stop Powershell Script remotely, only signed powershell script is allowed.

Not sure about this @gcusello 

[gcusello]

Hi @monug8,

at first check if DNS monitoring is enabled at Windows level (not in Splunk).

Then check if the user used to run Splunk has the righrs to execute Powershell scripts.

Ciao.

Giuseppe

[monug8]

@gcusello , I said in last post, we are not allowing any powershell script can be executed on DNS server so that is the issue here, you believe.

Is the DNS server log kicks off PS script as part of collecting logs from Event Viewer.

what do you mean by  DNS monitoring is enabled at Windows level . is this related to DNS logging and diagnostics?

I can see DNS events in Event Viewer so it means DNS monitoring is enabled on windows level.

Thanks

[gcusello]

Hi @monug8 ,

are there in the Windows Event Viewer (not in Splunk) the events from DNS?

if yes, they already arrive in Splunk you should find them in wineventlog, if thery aren't in Windows Event Viewer, you have to enable DNS logging on Windows.

If they are in Windows Event Viewer but not in Splunk and you have other EventLogs, check if there's ome whitelist or blacklist in inputs.conf.

Ciao.

Giuseppe

[gcusello]

Hi @monug8,

let me understand:

did you installed the Universal Forwarder on the DNS Server?

are you receiving other logs from that host?

did you enabled logging on DNS Server?

Ciao.

Giuseppe

[monug8]

Hi @gcusello yes, I have Installed UF on windows  machine where DNS Server role is installed

yes, I am receiving other OS logs (WinEventLog:Application, Security) to splunk indexer

yes, I enabled DNS logs as per below:

#### WinEventLog Inputs for DNS ########

[WinEventLog:// DNS Server]

disabled=0

renderXml=false

index = microsoft_windwos

Still not getting DNS logs, I can see those logs in Event Viewer on windows but not appearing in Splunk indexer

Note: I am using Technical Addons called (Splunk_TA_windows)

Thanks

[PickleRick]

Did you copy-paste that config excerpt? Because there is most probably a typo here.

index = microsoft_windwos

If you have a last-chance index set your events would land there. If you don't, they would get discarded.

Unless of course your index is indeed called "microsoft_windwos"