Use Splunk for Vault Monitoring

Introduction

This document contains some steps to configure Splunk® to report and gather data from your Vault environment and make it available through a web interface for your desktop, tablet or mobile device. Splunk offers monitoring and alert capabilities in real-time based on thresholds conditions around the clock. Build charts and dashboards to show important trends, top values and frequency of reoccurring events.

Vault Log Files

Vault log files can be monitored and indexed for reporting on a dashboard. This section explains how to configure Splunk to index the files and extract data to build dashboards and reports.

Log File Setup

To configure Splunk to index the log files, perform the following steps:

1. Select Settings > Data Input on the menu.
2. Click Files & Directories.
3. Click the New button to add an input.
4. In the Preview Data page, navigate to the location of the Vault log files. If you have installed Splunk on the same server as the Vault server, you can use “C:programdataautodeskvaultserverfilestore” for the location. If you have installed Splunk on a different server than the Vault server, you have to share the location of the Vault log files and use a UNC path at this step.
5. Click Next
6. Click the New button for the Source Type.
7. In the Source Type field enter
8. Select Custom as the Source Type Category.
9. Enter a description if you want in the description field.
10. Click Review then click Submit.

Field Extractions

When monitor Vault log files, information can be extracted for charting and reporting. Create extraction fields for the logs to get this information.

1. Select Settings > Fields on the menu.
2. Click Add New next to Field Extractions
3. Click the New
4. Select Search in the Destination app drop-down
5. Use the chart below to create the field extractions.
6. Click Save when you are done.

Creating a Search Once your extractions have been creating, you are ready to create reports and a dashboard.

1. Select Search & Reporting from the App pull-down menu in the top left corner of the page.
2. In the Search field, you can use the example search screens below.
3. Also, you can create custom searches by clicking Data Summary
4. Click the Sourcetypes tab and select the Vault_Logs type.
5. A list appears with data from the logs.
6. Click the All Fields
7. Place a check next to the names of all of the field extractions you created.
8. Click the X in the upper right corner to close the dialog.
9. Your custom fields appear on the left of the data. Click one of the fields to see the results.
10. Once you like your search, you can click the Visualization tab to see and change a chart format.
11. Click Save As in the upper right corner of the search and save it as a report.
12. Give it a name and save it.
13. Click Add to Dashboard
14. Create a new dashboard or use an existing one and add the chart to it.

Report for Hosts Connections sourcetype= “Vault_Logs” | top limit=20 Host

Report User Logins

sourcetype=”Vault_Logs” Username=”*” Log_Type=Acquired Username!=JobUser | top limit=20 Username

Note: “JobUser” is the account that the Job Processor(s) are running under.

Reported Exceptions in vlogs

sourcetype=”Vault_Logs”| top limit=20 Exception

Summary

Splunk is a very powerful tool which you can add lots of data to monitor your Vault environment. You can include Event Viewer, IIS, SQL data and anything else you can think of. Now go for it!