splunk
papercut add-on
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Technical Add-on for PaperCut version 1.0.0
For documentation, see: https://www.papercut.com/support/resources/manuals/ng-mf/common/topics/customize-data-access.html
Hardware Requirements
PaperCut NG/MF
Installation Steps - Best practice
1. Copy original "TA-papercut" and create "TA-papercut_inputs"
a. Within the TA-papercut_inputs/ create a local folder.
b. Copy the inputs.conf from the default folder into the local folder.
c. Edit the inputs.conf and change disabled=true to disabled=false
2a. Install on the following machines (preferred)
a. Deployment Server : place both add-on in
$SPLUNK_HOME/etc/deployment-apps (linux) or
$SPLUNK_HOME\etc\deployment-apps (windows).
b. Deploy "TA-papercut" to Search Head(s) / Indexer(s).
c. Deploy "TA-papercut_inputs" to Universal Forwarder(s) that contain your
log files. Documentation from the URL above states they should be in some
directory like below.
C:\Program Files\PaperCut MF\server\logs\print-logs\printlog_*.log.
- update inputs.conf monitor stanza if your host differs.
d. Issue reload deploy server command
- Splunk service should restart (not the OS)
2b. Install on the following machines (no deployment server or cannot use it)
a. Search Head(s) / Indexer(s) : place "TA-papercut" add-on in
$SPLUNK_HOME/etc/apps (linux) or $SPLUNK_HOME\etc\apps (windows).
b. Restart the Splunk service for each Search Head(s) / Indexer(s).
c. Universal Forwarder(s) : place "TA-papercut_inputs" add-on in
$SPLUNK_HOME/etc/apps (linux) or $SPLUNK_HOME\etc\apps (windows).
Documentation from the URL above states your logs should be in a directory
like below.
C:\Program Files\PaperCut MF\server\logs\print-logs\printlog_*.log.
- update inputs.conf monitor stanza if your host differs.
if you'd like to attribute additional redacted log samples or have comments/concerns. Please contact me at mfeeley@nuharborsecurity.com with the Subject line containing the add-on name.
For documentation, see: https://www.papercut.com/support/resources/manuals/ng-mf/common/topics/customize-data-access.html
Hardware Requirements
PaperCut NG/MF
Installation Steps - Best practice
1. Copy original "TA-papercut" and create "TA-papercut_inputs"
a. Within the TA-papercut_inputs/ create a local folder.
b. Copy the inputs.conf from the default folder into the local folder.
c. Edit the inputs.conf and change disabled=true to disabled=false
2a. Install on the following machines (preferred)
a. Deployment Server : place both add-on in
$SPLUNK_HOME/etc/deployment-apps (linux) or
$SPLUNK_HOME\etc\deployment-apps (windows).
b. Deploy "TA-papercut" to Search Head(s) / Indexer(s).
c. Deploy "TA-papercut_inputs" to Universal Forwarder(s) that contain your
log files. Documentation from the URL above states they should be in some
directory like below.
C:\Program Files\PaperCut MF\server\logs\print-logs\printlog_*.log.
- update inputs.conf monitor stanza if your host differs.
d. Issue reload deploy server command
- Splunk service should restart (not the OS)
2b. Install on the following machines (no deployment server or cannot use it)
a. Search Head(s) / Indexer(s) : place "TA-papercut" add-on in
$SPLUNK_HOME/etc/apps (linux) or $SPLUNK_HOME\etc\apps (windows).
b. Restart the Splunk service for each Search Head(s) / Indexer(s).
c. Universal Forwarder(s) : place "TA-papercut_inputs" add-on in
$SPLUNK_HOME/etc/apps (linux) or $SPLUNK_HOME\etc\apps (windows).
Documentation from the URL above states your logs should be in a directory
like below.
C:\Program Files\PaperCut MF\server\logs\print-logs\printlog_*.log.
- update inputs.conf monitor stanza if your host differs.
if you'd like to attribute additional redacted log samples or have comments/concerns. Please contact me at mfeeley@nuharborsecurity.com with the Subject line containing the add-on name.
Release Notes
Version 1.0.0
Dec. 21, 2018
add-on was test in an AWS EC-2 instances from Splunk versions 6.5-7.2 Could potentially work with older versions.