@eredux is there a reason you cannot explicitly define the local/inputs.conf to monitor the files you want? E.G., rather than trying to monitor all of /var/* files and choking on the binary files, explicitly monitor the *.log files desired? ## Audit [monitor:///var/log/audit.log*] index = myauditindex [monitor:///var/log/messages.log*] index = myauditindex sourcetype = myauditsourcetype ... View more