Getting Data In

Monitoring changes to configuration files

kkuminsky
Path Finder

Trying to monitor changes to configuration files.

Followed this article: http://www.splunk.com/base/Documentation/4.0.9/Admin/Monitorchangestoyourfilesystem

Created Data Input in Splunk Manager. Here is the inputs.conf (added pollPeriod manually):


[monitor://\192.168.1.12\Siteroot\Web.config]

disabled = false

host = SIT-APP-shared

host_regex =

host_segment =

index = main

sourcetype =

pollPeriod = 60


Restarted splunk after changes, share has full permissions for everyone.

Then I change web.config file. Do search in Splunk - nothing.

Does the configuration look right? How do I debug it to see if it's connecting to the share, how often, error messages etc.?

Tags (1)
1 Solution

kkuminsky
Path Finder
0 Karma

kkuminsky
Path Finder

OK, the reason it was not working is that Splunk services were running under Local System account.

Here are the articles I used to fix it:

http://www.splunk.com/base/Documentation/latest/Installation/InstallonWindows#Choosing_the_user_Splu...

http://www.splunk.com/base/Documentation/latest/Installation/CorrectingtheuserselectedduringWindowsi...

0 Karma

kkuminsky
Path Finder

It appears that it's working for local files - [fschange:C:\TEMP\test.txt], but not for network - [fschange:\10.255.1.20\Siteroot\Web.config]

So, I guess the question is how to monitor files on other machines in the network.

0 Karma

the_wolverine
Champion

What you want to do is fschange (filesystem change) monitoring which is different from monitoring. If you modify you configuration to look like that in the example on the page you linked to, it should work:

[fschange:/var/apache] 
index = sample 
recurse = true 
followLinks = false 
signedaudit = false 
fullEvent = true 
sendEventMaxSize = 1048576 
delayInMills = 1000 

kkuminsky
Path Finder

Yes, you are right. It looks like I shouldn't rely that much on GUI.

So, I've changed the config (see below). Now I don't see this record in Splunk Manager under Data Inputs anymore. Also, when I make changes to the file I'm still not able to find any records when doing search.


[fschange:\10.255.1.20\Siteroot\Web.config]

index = main

recurse = true

followLinks = false

signedaudit = false

fullEvent = true

sendEventMaxSize = 1048576

delayInMills = 1000

pollPeriod = 60

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...