topic Re: Universal Forwarder Dosn't forward new generated log files in Getting Data In

Universal Forwarder Dosn't forward new generated log files

Hussein90 — Thu, 18 Nov 2021 06:59:13 GMT

Dear Friends

I have installed a universal forwarder on Free_PBX to forward call queue logs to Splunk enterprise, everything works probably. I monitored the folder of logs which is located on /var/log/asterisk

I can monitor all log files while they are updating events daily but PBX generates a new log file every day these newly generated logs I can't find on Splunk enterprise. unless I restart universal forwarder then new log files appears on the data summary !

note: FREE_PBX is a Linux CentOS Based VOIP Server

Logs on Splunk

Logs on server

Re: Universal Forwarder Dosn't forward new generated log files

scelikok — Thu, 18 Nov 2021 08:40:02 GMT

Hi @Hussein90,

Could you please share your inputs.conf file setting for these asterisk log files?

Re: Universal Forwarder Dosn't forward new generated log files

Hussein90 — Thu, 18 Nov 2021 08:56:15 GMT

Dear scelikok

There isn't inputs.conf file in the diretory /opt/splunkforwarder/etc/system/local

Re: Universal Forwarder Dosn't forward new generated log files

scelikok — Thu, 18 Nov 2021 09:02:28 GMT

Hi @Hussein90,

The inputs.conf file location depends on how you created the monitor. If you created using GUI on deployment server it should have created an app for UF. You can search under /opt/splunkforwarder/etc/apps folder.

Or you can use btool on UF using below command

/opt/splunkforwarder/bin/splunk btool inputs list --debug | grep local

You can share output of above command

Re: Universal Forwarder Dosn't forward new generated log files

Hussein90 — Thu, 18 Nov 2021 09:23:32 GMT

Dear Scelikok

I've found following inputs.conf when I run the command you gave me

/opt/splunkforwarder/etc/apps/search/local/inputs.conf

inputs.conf contents

[monitor:///var/log/asterisk]
disabled = false

Re: Universal Forwarder Dosn't forward new generated log files

scelikok — Thu, 18 Nov 2021 12:23:16 GMT

Thank you @Hussein90,

Unfortunately, I cannot think of any reason. It may be a permission problem or the files could be very similar, but in those cases, you cannot index them by restarting UF.

Re: Universal Forwarder Dosn't forward new generated log files

Hussein90 — Thu, 18 Nov 2021 12:28:34 GMT

Thanks for your answer I think the issue is that UF cannot send newly generated logs, of course, we chose a folder to monitor but UF wont upload new log files only one-shot upload nd keep update the events