Getting Data In

monitoring changes to a remote filesystem

kaplan71
New Member

Hi there --

I completed installing the latest version of Splunk on two systems where the first is the server, and the second is the client. The former has been configured to receive data on port 9997 while the latter has been set up to forward data on the same port. Both systems use Linux operating systems.

What I am trying to set up between the two is a file integrity monitoring of the client from the server. I had several questions concerning this:

  1. How can I verify the connection between the server and the client?
  2. What app, script or procedure, if there are any available, can I use to accomplish this task?
  3. What file(s) do I create and/or modify to let Splunk know what files and/or directories I want to monitor for unexpected changes?

Thanks.

Tags (1)
0 Karma

Genti
Splunk Employee
Splunk Employee

1 - If you are monitoring anything at all on the forwarder then you should (theoretically) see it immediately as you log on to your indexer on the search dashboard (this is assuming you are sending it to a visible index) . If you know you have data being monitored on the forwarder then try searching on the receiver for host= (make sure you use the forwarder's name)

2(+3) - Read the documentation on fschange and see if this is what you had in mind:
http://www.splunk.com/base/Documentation/4.1.4/Admin/Monitorchangestoyourfilesystem
Possibly, you are going to monitor the data on the forwarder and send it to the receiver. Let me know if more help is needed or if i have misunderstood your question (or if what i suggested doesnt work for ya )

Cheers,
.gz

0 Karma

kaplan71
New Member

Hi there --

I believe the connection between the server and client has been established. Listed below is an excerpt:

7/20/10
10:17:20.000 AM

localhost - - [20/Jul/2010:10:17:20 -0400] "POST / HTTP/1.1" 200 129 CUPS-Get-Classes client-error-not-found

* host=Hadron   Options|  
* sourcetype=cups_access   Options|  
* source=/var/log/cups/access_log 

The only thing that I am confused about is the mention of the localhost. Does that mean the readout is actually from the Splunk server, or is the information actually coming from the Hadron client system?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...