topic Re: Detecting removable media in Deployment Architecture

Detecting removable media

malex27 — Mon, 26 Aug 2013 13:37:26 GMT

I need to detect when a removable media (USB stick, CD, external disks, ...) is attached or detached to our Linux servers.

Anyone implemented it?

Thanks
Alessio

Re: Detecting removable media

rturk — Mon, 26 Aug 2013 13:43:44 GMT

Hi Malex27,

Typically, linux will write an entry into:
/var/log/messages

Whenever a USB device is plugged in or removed from the server. You can configure this to be manually monitored via a monitor stanza in your inputs.conf.

Alternatively, you can use the Splunk for Unix & Linux app to monitor the file and send the data to an Indexer for the purposes of reporting.

Hope this helps 🙂

Re: Detecting removable media

malex27 — Fri, 30 Aug 2013 08:32:26 GMT

Thanks R.Turk,

I guess the first one is the simpler way, I just need to figure out the search patterns.