A request from Grafana experts

Site Feedback
1

Hello,
First of all, I would like to thank the Grafana team for producing such a product. Unfortunately, one of the drawbacks of this product is the lack of sufficient documentation and the experts on this website are not responsive. I have been trying to do a simple task for a few days now, but unfortunately I have not found any solution to my goal so far.
I want to know who deleted which file on a file server, from which system, and at what date and time. To do this, I need to configure Grafana Alloy to send IDs 4660 and 4663 from the file server to the Grafana server, but I couldn’t find any examples of such a useful thing on the internet. I also asked AI, but the configuration file it generated didn’t work.
Providing examples like this can increase Grafana users.

Thank you.

2

Hi @hack3rcon I’m sorry you haven’t gotten the response that you were looking for.

Looking at your post, it isn’t really clear how to help you. This is likely a primary factor in why you haven’t gotten responses. It’s not clear what the IDs you refer to in your Grafana Alloy config – what they are. You haven’t indicated the research that you’ve done, your Grafana Alloy config, or what you’ve tried so far. Adding these details in a post with a more descriptive & specific title would maximize your chances of getting help & support from the community.

Please bear in mind that this is a community support forum where members across the community help one another; it’s very important to give them as much detail as possible to know what you’re facing, otherwise they’ll tend to pass your post over.

3

Hello,
Thank you so much for your reply.
Sorry, but your answer is strange to me. I have given the details and the IDs. For example, I expect the following configuration to only send me reports related to IDs 4660 and 4663, but it does not do so:

loki.process "windows_event_logs" {
  forward_to = [loki.write.default.receiver]

  stage.regex {
    expression = ".*EventID=\"(4660|4663)\".*SubjectUserName=\"(?P<username>[^\"]+)\".*ObjectName=\"(?P<file>[^\"]+)\".*ObjectType=\"(?P<folder>[^\"]+)\".*Computer=\"(?P<hostname>[^\"]+)\".*IpAddress=\"(?P<ip_address>[^\"]+)\".*TimeCreated=\"(?P<timestamp>[^\"]+)\".*"
  }

  stage.labels {
    values = {
      file       = "file",
      folder     = "folder",
      hostname   = "hostname",
      ip_address = "ip_address",
      timestamp  = "timestamp",
      username   = "username",
    }
  }

  stage.timestamp {
    source = "timestamp"
    format = "RFC3339"
  }
}

loki.relabel "windows_event_logs" {
  forward_to = [loki.process.windows_event_logs.receiver]

  rule {
    source_labels = ["__name__"]
    target_label  = "__name__"
  }
}

loki.source.windowsevent "windows_event_logs" {
  eventlog_name          = "Security"
  xpath_query            = "*[System[(EventID=4660 or EventID=4663)]]"
  poll_interval          = "0s"
  use_incoming_timestamp = true
  forward_to             = [loki.relabel.windows_event_logs.receiver]
  labels                 = {
    job = "windows_event_logs",
  }
  legacy_bookmark_path = "./bookmark.xml"
}

loki.write "default" {
  endpoint {
    url = "http://192.168.1.2:3100/loki/api/v1/push"
  }
  external_labels = {}
}

As a Grafana expert, can you tell me where my configuration is wrong? I only want reports for IDs 4660 and 4663 to be sent from Windows to the Grafana server.

4

you have the same question in another thread

5

Hello,
Yes. I said this in response to the above request.