Hello,
We have some filesystem monitoring set up across our enterprise but it does not seem to be working.
The machines are all windows machines, monitoring files in paths without spaces seems to be working fine (i.e. c:\windows\system32) but any path with a space (i.e. c:\Program Files) is not working. Do I have to escape the space in the path to do this? I have tried a forward slash to no avail. How do I do this?
Example:
[fschange:C:\Program/ Files\SoftwarePackage]
index=main
recurse=true
followLinks=false
signedaudit = false
pollPeriod=3600
hashMaxSize=N
fullEvent=false
sendEventMaxSize = 1048576
delayInMills = 1000
filters = binaries,xml-files,terminal-blacklist
Thanks for your help.
Kevin
You may be hitting a known issue. This answer discuss it, and potential work-arounds:
http://answers.splunk.com/questions/2882/using-fschange-to-monitor-windows-filesystem
Oh, this is on a forwarder running 4.1.4 and the main server is running 4.1.6.
Thanks.