topic Re: Forward to indexer all except from particular path in Deployment Architecture

Forward to indexer all except from particular path

Wojt3k — Fri, 13 Aug 2021 12:40:55 GMT

Hello,

I would like to exclude just one user from forwarding logs and I am thinking if my solution will work:

in inputs.conf I would like to define:

[monitor:///home/nessus/.bash_history]
disabled = true

[monitor:///home/*/.bash_history]
disabled = false

The goal is to exclude logging data from user nessus but to log everybody else.

I am not sure if it's a good solution, maybe someone has better idea?

manjunathmeti — Fri, 13 Aug 2021 13:59:08 GMT

You can use deny list.

[monitor:///home/*/.bash_history] blacklist=nessus

m_pham — Mon, 16 Aug 2021 20:42:50 GMT

Check out the solution provided here:

In your case, it would be:

blacklist = \/nessus\/

Reference: