Does this app have the ability to resolve IPs to DNS names prior to sending them off to the syslog server? ... View more

I haven't anything pertaining to setting this up in a distributed environment. If i missed the docs can someone point me to them? If there is not anything that details any tips/trick, does anyone have any experiences with this? I haven't installed it yet, just trying to figure out if I'm going to waste my time or not 🙂 ... View more

Is there a max file count a single forwarder can monitor? I have some oracle applications that generate 10,000's of new files daily, various sizes. I have a dedicated host that has these shared mounts mounted up and just scanning for new data. Every how and again it crashes the box. I can't seem to make anything out on the console. Am I running into some sort of file limit? ... View more

Has anyone figured out how to monitor /dev/console? ... View more

So I'm at a loss here. .bashrc and .bash_profile are picked up just fine. however I can't get authorized_keys2 to be picked up unless I do something like /root/.ssh/* I wish to avoid known_hosts. I've tried just about everything can think of. What's weird is /root/.ssh/authorized_keys2 it self fails. Ideas? [fschange:/root/] filters = root_wl,all_bl fullEvent = true [filter:whitelist:root_wl] Key root files that should never change regex1 = [^/]authorized_keys2 regex2 = [^/].bash_profile regex3 = [^/]*.bashrc [filter:blacklist:all_bl] regex1 = .? ... View more

When ever a browser has the summary page loaded, there is a tremendous amount of IO. What exactly is this IO to/from? With out taking a huge dive into it, I know it's outbound IO and it's mostly "other" type of requests, like opening files and updating file system meta data. The Splunk file structure is NFS mounted. If I have too I could pull this data local to the OS with hopes the local file system caching could deal with these quests better on a normal file system. ... View more