Below is the path I am trying to monitor
C:\Program Files (x86)\Okta\Okta RADIUS Agent\current\logs\okta_radius and I used the following monitoring stanza
[monitor://C:\Program Files (x86)\Okta\Okta RADIUS Agent\current\logs\okta_radius]
index = okta
sourcetype = okta_radius
Is this the correct stanza or syntax?
That is a perfectly reasonable and fully functional setting.
Thank you.So it should be an issue with permission .Can we check specifically internal logs to see the error
Try this:
index=_* okta_radius (ERROR OR WARN* OR FAIL* OR CANNOT OR TIMEOUT OR CRASH* OR UNABLE)