We have tons of Linux machines which are all connected to Active Directory (AD). AD logs are being pulled in Splunk.

Is there a way to get the command history of all Linux machines in Splunk from AD logs (more like processes command line logs for Windows) without installing a Splunk forwarder in each one of them?


One solution would be to system syslog to a central syslog server, and running single Splunk Forwarder there. You could then bulk ingest logs, or only ingest logs for the systems you want. It also makes it a little easier to grow down the road as you can have any additional processes just syslog to the same server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.