Getting Data In

Directory monitoring / change monitoring questions

flo_cognosec
Communicator

Hi Guys

I am new to splunk and have been tasked with something that seems a bit challenging to achieve:

What I got

/directoryA/some_very_important_files
All changes need to be monitored

/directoryA/some_not_so_importand_files
new files / deleted files should be noted

Out of architectural issues this is not changeable and I would like to know how to best monitor this.

Do I have to use absolute paths like /directoryA/some_file.sh for all the files ?

Do I understand correctly that I cannot do this:
(
I want to get a "baseline" of all existing files and then subsequently get all the changes to the config files in the directory
)

monitor /directoryA

fschange /directoryA/file.sh

If I just want the config files to be fully imported and indexed (with content) and the binary files just to be indexed as existing (indexing some 3 meg binary file is actually quite useless I think) it seems to be possible but only with a lot of manual configuration ?

Last time I tried this with windows, I got a font file indexed roughly 800.000 times for no apparent reason 😕

0 Karma

flo_cognosec
Communicator

Note: Monitor inputs should not overlap. That is, monitoring /a/path while also monitoring /a/path/subdir will produce unreliable results. Similarly, monitor inputs that watch the same directory with different whitelists, blacklists, and wildcard components are not supported.

Sounds like a splunk limitaton here 😕

0 Karma

kristian_kolb
Ultra Champion

No, you cannot [monitor] and [fschange] the same files/directories, but you can 'index' the files with fschange, if you add fullEvent=true to your [fschange] stanza. However, I'm not sure that fschange will 'index' the files the first time it sees them, or if it's only when the file changes.

As for explicitly configuring the exact path to each file, I don't think it's necessary. If your config files all end with .conf, and no binary files do that, you can write blacklists/whitelists to ensure that the correct files get fschange-indexed (fullEvent=true). NB. I haven't tried this, and I'm not 100% sure if there will be some sort of conflict for the two fschange-stanzas pointing at the same directory.

In inputs.conf

[fschange:/directoryA/]
filters=skip_conf

[fschange:/directoryA/]
filters=incl_conf
fullEvent=true

[filter:blacklist:skip_conf]
regex1=.*\.conf$

[filter:whitelist:incl_conf]
regex1=.*\.conf$

Give it a shot, if you dare 🙂

/kristian

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...