Home / server / Questions / 1155672
Accepted
Egyas
Asked: 2024-03-05 04:50:34 +0800 CST

Splunk Enterprise - Configure to drop specific events

  • 772

I have a simply Splunk set-up.  about 120 or so Linux servers (that are all basically appliances) w/ universal forwarder installed, and a single Linux server running Splunk Enterprise acting as the indexer, search head, etc.

The problem I have is that the forwarders must feed the server's audit log into Splunk.  That feed is actually working fine, but it's flooding the server, and causing me to go over my license limit.  

Specifically, the appliance app has an event in cron that runs very often, and it's flooding the audit log with file access, file mod, etc events, which is ballooning the amount of data I send to Splunk Enterprise.  Data that Is simply do not need.

What I want to do is filter out these specific events, but ONLY for this specific user.  I believe this can be done using transforms.conf and props.conf  on the indexer, but I'm having trouble getting the syntax and fields right.

Can anyone assist with this?

Here's the data I need to remove... sourcetype=auditd acct=appuser exe=/usr/sbin/crond exe=/usr/bin/crontab

So basically ANY events in the audit log for user "appuser" that reference either "/usr/bin/crontab" or "usr/bin/crontab" need to be dropped.

Here's an example of the events I want to drop.

type=USER_END msg=audit(03/04/2024 15:58:02.701:5726) : pid=26919 uid=root auid=appuser ses=184 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct=appuser exe=/usr/sbin/crond hostname=? addr=? terminal=cron res=success'

type=USER_ACCT msg=audit(03/04/2024 15:58:02.488:5723) : pid=26947 uid=appuser auid=appuser ses=184 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct=appuser exe=/usr/bin/crontab hostname=? addr=? terminal=cron res=success'

Can this be done?

cron

2 Answers

  1. Best Answer

    It would help to know what you've tried so far and how those efforts failed you. What you want to do is possible. It's easier with a separate transform for each message to keep the regular expression from getting too messy.

    props.conf:

    [auditd]
TRANSFORMS-nocrond = dropcrond
TRANSFORMS-no crontab =dropcrontab

    transforms.conf:

    [dropcrond]
REGEX = acct=appuser exe=\/usr\/sbin\/crond
DEST = queue
FORMAT = nullQueue

[dropcrontab]
REGEX = acct=appuser exe=\/usr\/sbin\/crontab
DEST = queue
FORMAT = nullQueue

    It also can be done using Ingest Actions. Go to Settings->Ingest Actions to open the wizard for that.

    • 1

  2. I wound up combining RichG's response with some advice from another forum and came up w/ my answer.

    Here it is

    props.conf

    [source::auditd]
TRANSFORMS-set=setnull

    transforms.conf

    [setnull]
REGEX = acct=appuser.*exe=/usr/(sbin/crond|bin/crontab)
DEST_KEY = queue
FORMAT = nullQueue
    • 1