topic Appending to a whitelist in Getting Data In

Appending to a whitelist

Peter_B — Mon, 20 Sep 2010 21:53:43 GMT

We're using the unix app to monitor our linux machines. One of the files we need to monitor is /var/log/secure. The unix app has a monitor for /var/log with a _whitelist that does not include 'secure'. Rather than entirely overwrite that whitelist with an entry in in etc/system/local/inputs.conf, does anyone know of a way of appending to it (other than editing the inputs.conf in the unix app)? What I mean is can you do something like this -

[monitor:///var/log]
_whitelist=EXISTING-WHITELIST+'secure'

Thanks

Re: Appending to a whitelist

ftk — Mon, 20 Sep 2010 22:25:51 GMT

Unfortunately appending filters is only possible with the fschange monitor at this point.

Re: Appending to a whitelist

Stephen_Sorkin — Mon, 20 Sep 2010 23:10:11 GMT

Your best bet is to add another inputs stanza, rather than to augment the existing one. For example:

[monitor:///var/log/secure*]