Getting Data In

Can I monitor change on a remote file share directory?

samlinsongguo
Communicator

I am trying to monitor the change on a remote file share directory. I want to know when the file changed, who made the change if posside (uid is fine.) I have following config put in inputs.conf file:

[fschange://\\servername\E$\Monitor\]
index=sservice
pollPeriod=60
fullEvent=ture
sourcetype=MonitorDir

in Splunkd log I got following error message

`10-27-2017 16:39:22.643 +1100 WARN  FSChangeMonitor - Monitoring file or directory that doesn't exist at startup time - //\\scabby\E$\Monitor

Any suggestion what is going on there?
Thanks

0 Karma

paulbannister
Communicator

Unsure if this is still required or unanswered by try this as it worked for us, patience may be need if the directory is large and a full restart of the UF if you're using one:

[fschange:\servername\E$\Monitor]
index=sservice
sourcetype=MonitorDir
fullEvent=true
pollPeriod=60
recurse=true
sendEventMaxSize=100000
signedaudit=false
disabled=0

DalJeanis
SplunkTrust
SplunkTrust

The first thing I would do is check the spelling of the actual full route to the file. The character sequence //\\ looks suspicious to me, and I also wonder if E$ is intended to be literal.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...