Splunk Universal Forwarder

Splunk Universal Forwarder – Windows

To collect log information from a stand alone Windows (Vista in this case) workstation, download and install the Splunk Universal Forwarder

splunk-4.3-115073-x86-release.msi

Follow the install configuration and select the WindowsEventLog : Security and whatever performance monitoring is required. Enter the IP address of the Splunk indexer/search head and the host IP address as directed. If the default port (9997) was selected ensure that the indexer firewall is set to allow connections from the forwarder on this port.

In addition to the standard windows event logs:

Application log (tracks events that occur in a registered application)
Security log (tracks security changes and possible breaches in security)
System log (tracks system events)

a couple of useful logs to forward are the windows update log and the windows firewall log. Start Notepad and run as administrator. Open C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf and edit as follows:

[default]

host = acer-expire

[script://$SPLUNK_HOME\bin\scripts\splunk-perfmon.path]

disabled = 0

[monitor://$WINDIR\WindowsUpdate.log]

sourcetype = WindowsUpdateLog

disabled = 0

[monitor:C:\Windows\System32\LogFiles\Firewall\pfirewall.log]

sourcetype = WindowsFirewallLog

disabled = 0

Note enable windows firewall logging as follows:

Click Start, All Programs, and search for Administrative Tools.
Select Windows Firewall with Advanced Security.
Right click Windows Firewall with advanced security on local computer.
Select Properties and Profile tabs. customise logging.
Select log dropped packets and log successful connections.
Click OK.

Start Windows Task Manager and restart SplunkForwarder service.

NB The Splunk Universal Forwarder for windows must run as local admin, in order to forward the above logs. Linux/Solaris forwarders do not need to and should not run as root, but log group permissions may need to change to forward some logs.

Comments

GNU Radio Waterfall and CW Filter

The following GNU radio application adds a waterfall spectrogram to the previous CW filter program. The plot show 4 CW signals in the audio band (lower sideband) at 7023 kHz. The 700Hz signal is filtered and output to the laptop headphones by the CW bandpass filter. The frequency display is shown after the script which is as follows: #!/usr/bin/env python from gnuradio import gr from gnuradio import audio from lpf_bpf_class import Bandpass from gnuradio.qtgui import qtgui from PyQt4 import QtGui import sys, sip class cw_filter(gr.top_block): def __init__(self): gr.top_block.__init__(self) sample_rate = 44100 out_rate = 8000 kaiser = Bandpass() cw_flr = gr.fir_filter_fff(1, kaiser.bpftaps) decimate = int(sample_rate/out_rate) Bandpass.cutoff1 = 3000 pre_decim = Bandpass() dec_flr = gr.fir_filter_fff(1, pre_decim.lpftaps) dec = gr.keep_one_in_n(gr.sizeof_float, decima

Digital Bandpass Filter FIR design - Python

The python code generates the Finite Impulse Response (FIR) filter coefficients for a lowpass filter (LPF) at 10 (Hz) cut off using firwin from scipy. A highpass filter is then created by subtracting the lowpass filter output(s) from the output of an allpass filter. To do this the coefficients of the LPF are multiplied by -1 and 1 added to the centre tap (to create the allpass filter with subtraction). A second LPF is then created with a cutoff at 15 (Hz) and the bandpass filter formed by addition of the LPF and HPF coefficients. The program also generates a test sine wave of a given amplitude and power and to this noise from a Normal distribution is added. The graph below shows the signal and nois, and the signal (green) after filtering. The input snr is approximately 3dB. The frequency response below shows the passband centered on 12.5 (Hz), the Nyquist frequency is 50 (Hz). from numpy import cos, sin, pi, absolute, arange from numpy.random import normal from scipy.

Splunk Cheat Sheet (Linux)

1. set root's password: sudo su passwd root Enter new UNIX password: < new_root_password > Retype new UNIX password: < new_root_password > passwd: password updated successfully # su - 2. Remove any existing Splunk directories & create user etc: # rm -rf /opt/splunkforwarder # userdel -r splunk # this will remove as above if user splunk's home directory # groupadd siem # useradd -g siem -s /bin/bash -d /home/siem -m siem # vi ~/.profile # chage -I -1 -m -0 -M -99999 -E -1 siem If above fails because of multiple passwd fails: # pam_tally --reset check with #chage -l siem # uname -a # check OS version # dpkg -i splunk-4.3.1...........intel.deb # chown -R siem:siem /opt/splunk # su - siem : $SPLUNK_HOME/bin/splunk start --accept-license : $SPLUNK_HOME/bin/splunk edit user admin -password newpassword -role admin -auth admin:changeme 3. vi ~/.profile (as follows) (OR .bash_profile) # ~/.profile: executed by the command interpreter for log

G4AKW

Search This Blog