Monitor file system changes on Windows
Splunk Enterprise supports the monitoring of Windows file system changes through the Security Event Log channel. To enable monitoring of changes to files and directories, you first enable security auditing for the file(s) and folders you want to monitor for changes, then use the event log monitor to monitor the Security event log channel.
This procedure of monitoring file system changes replaces the deprecated file system change monitor input.
What do you need to monitor file system changes?
|Monitor file system changes||
Use the Security event log to monitor changes to files
You can monitor changes to files on your system by enabling security auditing on a set of files and/or directories and then monitoring the Security event log channel for change events. The event log monitoring input includes three attributes which you can use in
When using the Event Code/ID format:
When using the advanced filtering format:
When using the Event Log code/ID format:
When using the advanced filtering format:
||Tells Splunk Enterprise whether or not to include the message text that comes with a security event. A value of 1 suppresses the message text, and a value of 0 preserves the text.||0|
Note: You can use these attributes outside of the context of the Security event log and file system changes. Also, this list of attributes is only a subset of the available attributes for inputs.conf. For additional attributes, read "Monitor Windows event log data" in this manual.
Create advanced filters with
You can perform advanced filtering of incoming events with the
blacklist attributes in addition to filtering based solely on event codes. To do this, specify the key/regular expression format in the attribute:
whitelist = key=<regular expression> [key=<regular expression] ...
In this format,
key is a valid entry from the following list:
|$TimeGenerated||The time that the computer generated the event. Splunk Enterprise only generates the time string as the event.|
|$Timestamp||The time that the event was received and recorded by the Event Log service. Splunk Enterprise only generates the time string as the event.|
|Category||The category number for a specific event source.|
|CategoryString||A string translation of the category. The translation depends on the event source.|
|ComputerName||The name of the computer that generated the event.|
|EventCode||The event ID number for an event. Corresponds to "Event ID" in Event Viewer.|
|EventType||A numeric value that represents one of the the five types of events that can be logged ("Error", "Warning", "Information", "Success Audit", and "Failure Audit".) Available only on server machines running Windows Server 2003 and earlier or clients running Windows XP and earlier. See "Win32_NTLogEvent class (Windows)" (http://msdn.microsoft.com/en-us/library/aa394226(v=vs.85).aspx) on MSDN.|
|Keywords||An element used to classify different types of events within an event log channel. The Security Event Log channel has this element, for example.|
|LogName||The name of the Event Log channel that received the event. Corresponds to "Log Name" in Event Viewer.|
|Message||The text of the message in the event.|
|OpCode||The severity level of the event ("OpCode" in Event Viewer.)|
|RecordNumber||The Windows Event Log record number. Each event on a Windows server gets a record number. This number starts at 0 with the first event generated on the system, and increases with each new event generated, until it reached a maximum of 4294967295. It then rolls back over to 0.|
|Sid||The Security Identifier (SID) of the principal (such as a user, group, computer, or other entity) that was associated with or generated the event. See "Win32_UserAccount class (http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx) on MSDN.|
|SidType||A numeric value that represents the type of SID that was associated with the event. See "Win32_UserAccount class" (http://msdn.microsoft.com/en-us/library/windows/desktop/aa394507%28v=vs.85%29.aspx) on MSDN.|
|SourceName||The source of the entity that generated the event ("Source" in Event Viewer)|
|TaskCategory||The task category of the event. Event sources allow you to define categories so that you can filter them with Event Viewer (using the "Task Category" field. See Event Categories (Windows) (http://msdn.microsoft.com/en-us/library/aa363649%28VS.85%29.aspx) on MSDN.|
|Type||A numeric value that represents one of the the five types of events that can be logged ("Error", "Warning", "Information", "Success Audit", and "Failure Audit".) Only available on server machines that run Windows Server 2008 or later, or clients that run Windows Vista or later. See "Win32_NTLogEvent class (Windows)" (http://msdn.microsoft.com/en-us/library/aa394226(v=vs.85).aspx) on MSDN.|
|User||The user associated with the event. Correlates to "User" in Event Viewer.|
<regular expression> is any valid regular expression that represents the filters that you want to include (when used with the
whitelist attribute) or exclude (when used with the
You can specify more than one regular expression on a single entry line. When you do this, Splunk Enterprise logically conjuncts the expressions. This means that only events which satisfy all of the entries on the line will be valid for inclusion or exclusion. For example, this entry:
whitelist = EventCode="^1([0-5])$" Message="^Error"
tells Splunk Enterprise to include events that have an
EventCode ranging from 10 to 15 and contain a
Message that begins with the word
You can specify up to 10 separate whitelist or blacklist entries in each stanza. To do so, add a number at the end of the
blacklist entry on a separate line:
whitelist = key=<regular expression> whitelist1 = key=<regular expression> key2=<regular expression 2> whitelist2 = key=<regular expression>
Note: You cannot specify an entry that has more than one expression that references the same key. If, for example, you specify:
whitelist = EventCode="^1([0-5])$" EventCode="^2([0-5])$"
Splunk Enterprise ignores the first expression and only attempts to include events that match the second expression. In this case, only events that contain an
EventCode between 20 and 25 match. Events that contain an
EventCode between 10 and 15 do not match. Only the last expression in the entry ever matches.
To resolve this problem, specify two separate entries in the stanza:
whitelist = EventCode="^1([0-5])$" whitelist1 = EventCode="^2([0-5])$"
Monitor file system changes
To monitor file system changes for a set of files or directories:
1. Follow the instructions at "Auditing Security Events How To" (http://technet.microsoft.com/en-us/library/cc727935%28v=ws.10%29.aspx) on MS Technet to enable security auditing.
Important: You must have administrator privileges to perform this task.
2. Configure the Splunk Enterprise event log monitor input to monitor the Security event log channel.
Note: For specific instructions on how to configure the Event Long monitor input, read "Monitor Windows event log data" in this manual.
inputs.conf stanzas which show examples of how to monitor file system changes.
This stanza collects security events with event ID codes 0 to 2000 and 3001-10000.
[WinEventLog:Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000
This stanza collects security events with event ID codes 0 to 2000 and 3001-10000. It also suppresses the message text that comes in the event ID.
[WinEventLog:Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 # suppress message text, we only want the event number. suppress_text = 1 # only index events with these event IDs. whitelist = 0-2000,2001-10000 # exclude these event IDs from being indexed. blacklist = 2001-3000
Monitor Windows event log data
Monitor WMI-based data
This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15