Deploying the Splunk App for Microso> Exchange

Size: px

Start display at page:

Download "Deploying the Splunk App for Microso> Exchange"

Angelica Ward
10 years ago
Views:

2 Disclaimer During the course of this presentahon, we may make forward- looking statements regarding future events or the expected performance of the company. We cauhon you that such statements reflect our current expectahons and eshmates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward- looking statements, please review our filings with the SEC. The forward- looking statements made in the this presentahon are being made as of the Hme and date of its live presentahon. If reviewed a>er its live presentahon, this presentahon may not contain current or accurate informahon. We do not assume any obligahon to update any forward- looking statements we may make. In addihon, any informahon about our roadmap outlines our general product direchon and is subject to change at any Hme without nohce. It is for informahonal purposes only, and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligahon either to develop the features or funchonality described or to include any such feature or funchonality in a future release. 2

For important factors that may cause actual results to differ from those contained in our forward- looking statements, please review our filings with the SEC.

3 About Me Jeff Bernt:! At Splunk for ~ a year and a half! QA responsible for Microso> Apps! Previously at Expedia; managed their enhre Splunk infrastructure, end to end! Microso> SDET before that, working on Exchange, SharePoint, and System Center! TwiYer/IRC: DaGryph 3

Previously at Expedia; managed their enhre Splunk infrastructure,

4 Agenda! Problem: You have Microso> Exchange issues, but they are difficult to locate and resolve easily. The new Splunk App for Microso> Exchange can help you with these issues, but it requires a potenhally complex installahon process in order to deploy fully.! SoluHon: This talk will be about common pain points and resoluhons in order to get the app and addons deployed successfully.! Why are we doing this? We want to make sure you are successful with our new app!! Typical distributed deployment architecture! Common issues and fixes! Common customizahons! Summary 4

deploy fully.! SoluHon: This talk will be about common pain points and resoluhons in order to get the app and add- ons deployed successfully.

5 Deployment Architecture

6 Deployment Architecture Deployment server Collect and send data Retrieve data Universal Forwarder Indexer Search Head 6

7 What Goes Where Each Tier Splunk Universal forwarder + appropriate addons NaHve inputs Event log, Perfmon, etc. PowerShell scripts Splunk Enterprise + appropriate addons Knowledge layer extrachons Splunk Enterprise + appropriate Apps Dashboards and VisualizaHons Search Hme extrachons 7

PowerShell scripts Splunk Enterprise + appropriate add- ons Knowledge

8 Examples for Supported Apps Splunk Add- on for Windows TA- Exchange- <ver>- <role> TA- Windows- <ver>- Exchange- IIS (CAS only) Splunk Add- on for Windows TA- DomainController- NTx TA- DNSServer- NTx Splunk Add- on for Windows Splunk_TA_vmware SA- UHls / SA- Hydra Splunk_TA_esxilogs Splunk Add- on for Windows Splunk App for Exchange TA- SMTP- ReputaHon Splunk Add- on for Windows Splunk Add- on for Windows Splunk_TA_vcenter Splunk App for Windows Infrastructure Splunk_TA_Windows Splunk App for Microso> Exchange Splunk_TA_Windows Splunk App for Windows Infrastructure Splunk_TA_Windows Splunk App for VMware 8

for Windows Splunk App for Exchange TA- SMTP- ReputaHon Splunk Add- on for Windows Splunk Add- on for Windows Splunk_TA_vcenter Splunk App for Windows

9 Demo 9

10 Common Deployment Issues and Fixes

11 IniHal Deployment of UF! How to install as part of an image Configure the Splunk UF as required, deployment server, indexer(s), etc. Stop Splunk and run:.\splunk clone- prep- clear- config, which will clear the forwarder specific items such as name and GUID Note: TA- Windows is required Splunk_TA_Windows comes turned off out of the package, you must configure and enable the inputs you re looking for. Then, deploy Splunk_TA_Windows to forwarders, search heads, AND the indexers LocaHon: $ 11

$\splunk clone- prep- clear- config, which will clear the forwarder specific items such as name and GUID Note: TA- Windows$

12 Deployment Server! Copy Add- ons FROM: C:\Program Files\Splunk\etc\splunk_app_microso>_exchange \appserver\addons! TO: Deployment Server: C:\Program Files\Splunk\etc\deployment- apps! Make all changes to configurahon within the etc\apps\<ta>\local\ folder! Don t forget, SA- ModularInput- PowerShell requires addihonal steps for architecture (x86 vs x64)! Make sure your serverclass.conf file appropriately matches the addons to the versions of the OS and Technology. All Technology Add- ons are published with the app 12

$Make all changes to configurahon within the etc\apps\<ta>\local\ folder!$

13 Universal Forwarder! Alter configurahon files to match your indexing scheme Message Tracking Logs alter for the actual locahon ê TA: For Exchange 2007 and 2010: TA- Exchange- <ExchangeVersion>- HubTransport ê TA: For Exchange 2013: TA- Exchange Mailbox IIS Logs same idea for monitor path, my TwiYer account has more info 13

for the actual locahon ê TA: For Exchange 2007 and 2010: TA- Exchange-

14 PowerShell on the UF! Enable PowerShell May need to install and/or enable via GPO Set- execuhonpolicy RemoteSigned SA- ModularInput- PowerShell, if you get errors in the UI about PowerShell, or things aren t working, verify: ê Requirements: ê Windows Management Framework 3.0 ê.net Framework 4.5 ê If using the 64bit version of the modinput, copy the SA- ModularInput- PowerShell \windows_x86_64\bin to SA- ModularIinput- PowerShell\bin, else copy the x86 version to the SA- ModularInput- PowerShell\bin folder. Unblock (if necessary) the downloaded PowerShell scripts, defaults to AllSigned hyp://docs.splunk.com/documentahon/achvedirectory/latest/deployad/ EnableAudiHngandPowerShellondomaincontrollers 14

$5 ê If using the 64bit version of the modinput, copy the SA- ModularInput- PowerShell \windows_x86_64\bin to SA- ModularIinput- PowerShell\bin, else copy the x86 version to the$

15 Universal forwarder! Install A Universal Forwarder on all servers Domain user / Local system privileges Open the Advanced Firewall (ports 8089 / 9997) if necessary! Connect Forwarder to Deployment Server and Indexing Her Control app and TA management Controls what to send to the indexer Controls where to send the data 15

privileges Open the Advanced Firewall (ports 8089 / 9997) if necessary!

16 Indexer! Indices perfmon for performance Data msexchange for all other exchange data msad for all AD data wineventlog for Windows Eventlog data main for everything else, though shouldn t be needed TA- windows indexes.conf, index issues, CIM compliancy Example: I m not seeing all the data from our Exchange infrastructure with 100,000 users! ê Adjust the maxdatasize below to a larger value such as 500,000 (in megabytes) ê Verify permissions for adding users to role exchange- admin Index configurahon - hyp://docs.splunk.com/documentahon/splunk/6.1.3/indexer/configureindexstorage 16

everything else, though shouldn t be needed TA- windows indexes.

17 Turn on Audit Logs! Impact of not having audit logs turned on? Reports/dashboards within the App do not return any results. This is true for Windows data, AcHve Directory data, as well as Exchange data! How do you turn on audit logs? Create GPO in AcHve Directory that has audihng turned on Link to Domain Controller OU! Sample command to turn on audit on Mailboxes 17

This is true for Windows data, AcHve Directory data, as well as Exchange data!

18 Common CustomizaHons

19 Exchange: Configuring TA- SMTP- ReputaHon! Needs to be on a machine which has Global DNS Access Recommend indexer as long it has internet access outbound If not, install on heavy forwarder Dependency on Python; cannot be on Universal forwarder! Copy default/reputahon.conf to local/reputahon.conf! Add in your OUTBOUND mail servers GLOBAL IP ADDRESSES

internet access outbound If not, install on heavy forwarder Dependency on Python;

20 Exchange: CustomizaHons! `Is- internal- ip(<ip- addr>)` Checks if a given ip address is internal By default, set to RFC and FE80:: for internal! Roles and Permissions, authorize.conf changes Windows- admin (default Windows index searching) Winfra- admin (includes Windows, adds MSAD) Exchange- admin (includes Windows, MSAD, Exchange) 20

set to RFC- 1918 and FE80:: for internal! Roles and Permissions, authorize.

21 ! Full session on this! New SA- LDAPSearch!! IntegraHng AcHve Directory with Your Splunk Searches 21

22 Summary

23 Key Takeaways! MulH- Hered deployments Data collechon, Indexing, Searches/ Dashboards! Highly customizable app to meet specific enterprise requirements! Wealth of documentahon with examples - hyp://docs.splunk.com/documentahon/msexchange/

24 AddiHonal Resources Download Splunk App for Microso> Exchange hyp://apps.splunk.com/app/1660/ Related.conf sessions! IntegraHng AcHve Directory with Your Searches Visit the Apps Showcase Microso> Booth Talk to the experts! 24

25 QuesHons?

26 Special Offer: Try Splunk MINT Express for Free! Splunk MINT offers a fast path to mobile intelligence. How fast? Find out with a 6- month trial* Register for your free trial: hyp://mint.splunk.com/conf2014offer Download the Splunk MINT SDKs Add the Splunk MINT line of SDK code and publish** Start ge~ng digital intelligence at your fingerhps! *Offer valid for.conf2014 a5endees and coworkers of a5endees only. **Trial allows monitoring of up to 750,000 monthly acdve users (MAUs). 26

27 THANK YOU

Deployment Best PracHces for Splunk Apps Monitoring MicrosoK- based Infrastructure

Copyright 2013 Splunk Inc. Deployment Best PracHces for Splunk Apps Monitoring MicrosoK- based Infrastructure Sharad Kylasam Sr. Product Manager Jeff Bernt - SDET #splunkconf Legal NoHces During the course