infrastructure-notes/AFS Syslog Notes.md

AFS Syslog Notes

The AFS Customer has a different syslog setup than other customers. This document was created to track some of those differences.

Splunk Searches

Is data not being tagged correctly and instead going into the junk index?

index=junk sourcetype="*syslog"

What index is the syslog data going into?

See this file: https://github.xdr.accenturefederalcyber.com/mdr-engineering/msoc-afs-pop/blob/master/deployment-apps/afs_hf_inputs/local/inputs.conf

There are multiple indexes containing the syslog data. Here is a search to look through the data for specific missing hosts.

index=junk OR index=network_firewall OR index=network OR index=ids source="*syslog*" host=pic1-rwc-0101 OR host=pic1-rwc-0102 OR host=pic1-csw-0001 OR host=pic1-csw-0002 OR host=pic1-srt-0003 OR host=pic1-srt-0004 OR host=sat-ntp-0101 OR host=sat-ntp-0102

| tstats count WHERE (host=10.55.255.140 OR host=pic1-rwc-0101 OR host=pic1-rwc-0102 OR host=pic1-csw-0001 OR host=pic1-csw-0002 OR host=pic1-srt-0003 OR host=pic1-srt-0004 OR host=sat-ntp-0101 OR host=sat-ntp-0102) (index=junk OR index=network_firewall OR index=network OR index=ids) by host, index | eval index=if(index="junk","staging",index)