topic Re: Monitoring of remote directory in Deployment Architecture

Monitoring of remote directory

sushma7 — Thu, 13 Mar 2014 10:33:56 GMT

Hi Team,

I have installed Universal forwarder on one of the box that I need to monitor.In that machine I want to monitor a particular folder under E drive, say E:\Splunk. The splunk folder has inturn two more directories ftplogs and NPCI. The NPCI inturn has set of directories which inturn has some logs in it. Splunk can monitor only few directories under NPCI but not all, why is it happening so? Need your suggestion.

Thanks in advance for your help!

Regards,
Sushma.

Re: Monitoring of remote directory

Ayn — Thu, 13 Mar 2014 10:55:34 GMT

Impossible to say without more details. General troubleshooting tips: check splunkd.log for errors, use amrit's script at http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ to see which file inputs Splunk has and what status they have.

Re: Monitoring of remote directory

sushma7 — Mon, 28 Sep 2020 16:07:20 GMT

To be more clear i shall say this way E:\Splunk has 2 folders ftplogs and ncpi. ftplogs has 5 more folders in it say a,b,c,d,e. the folder a has 10 log files in it with names SystemOut_14.03.2014_18.07.01, SystemOut_14.03.2014_18.07.02 like that ....till 18.07.10. But from SPLUNK machine I could just view only the first log file but not the rest, though I gave monitor=[E:\Splunk] under inputs.conf file

Re: Monitoring of remote directory

sushma7 — Fri, 14 Mar 2014 05:27:32 GMT

Kindly someone help me on this

Re: Monitoring of remote directory

Ayn — Fri, 14 Mar 2014 06:05:17 GMT

Have a look at the troubleshooting tips I gave you.

Re: Monitoring of remote directory

sushma7 — Fri, 14 Mar 2014 06:14:04 GMT

Under inputs.conf file i just enetered [monitor:///E:Splunk]
disabled =false
recursive = true
Is thereanything more I need to enter?

Re: Monitoring of remote directory

Ayn — Fri, 14 Mar 2014 08:46:12 GMT

Please read the troubleshooting tips I gave you.

Re: Monitoring of remote directory

woodcock — Mon, 25 May 2015 04:04:39 GMT

It is likely that the files contain identical content in important sections and have the same CRC so are being interpreted as the same file (only forward it once):
http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled

You can Salt with the filename with crcSalt= so this will not happen.