topic Re: Why isn't lsof / open files working in *NIX? in Deployment Architecture https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13078#M208 <P>What search command are you running?</P> <P>Does "sourcetype=lsof index=os earliest=-1d" return any events?</P> Sat, 08 May 2010 08:25:35 GMT bwooden 2010-05-08T08:25:35Z Why isn't lsof / open files working in *NIX? https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13077#M207 <P>I activated *NIX, and it's collecting all other types of data about the system, but I get no data entries for lsof. The script runs correctly when I invoke it myself (/opt/splunk/etc/apps/unix/bin/lsof.sh), and the input source is definitely enabled.</P> <P>My uname: Linux 2.6.9-023stab051.3-enterprise #1 SMP Wed Nov 4 19:28:06 MSK 2009 i686 i686 i386 GNU/Linux</P> Fri, 07 May 2010 07:58:18 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13077#M207 GuyPaddock 2010-05-07T07:58:18Z Re: Why isn't lsof / open files working in *NIX? https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13078#M208 <P>What search command are you running?</P> <P>Does "sourcetype=lsof index=os earliest=-1d" return any events?</P> Sat, 08 May 2010 08:25:35 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13078#M208 bwooden 2010-05-08T08:25:35Z Re: Why isn't lsof / open files working in *NIX? https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13079#M209 <P>Did that work for you ? </P> Thu, 16 Feb 2012 01:19:11 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13079#M209 asarolkar 2012-02-16T01:19:11Z Re: Why isn't lsof / open files working in *NIX? https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13080#M210 <P>Posted our workaround for this bug here: <A href="http://splunk-base.splunk.com/answers/78143/why-is-lsof_sossh-not-returning-any-data">http://splunk-base.splunk.com/answers/78143/why-is-lsof_sossh-not-returning-any-data</A></P> Sat, 20 Apr 2013 04:49:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Why-isn-t-lsof-open-files-working-in-NIX/m-p/13080#M210 heybigben 2013-04-20T04:49:40Z