topic fschange, file system change detection not working, how do I verify? in Getting Data In

fschange, file system change detection not working, how do I verify?

clyde772 — Wed, 12 May 2010 11:12:35 GMT

I have changed input.conf and restarted Spulnk, but I can't see any event generated for changing /etc/hosts file.

The the procedure was

Added inputs.conf for fschange conf.
Restarted Splunk.
Changed /etc/hosts file to see splunk generated event
logined to Splunk for fschange log.

And the I coould find the fs change log. Am I missing any procedure?

=====================================

[root@splunk local]# pwd
/opt/splunk/etc/system/local
[root@splunk local]# cat inputs.conf
[default]
host = splunk

[fschange:/etc]
index=os
recurse=true
followLinks=true
pollPeriod=60
fullEvent=true

=====================Splunk Restarted

Re: fschange, file system change detection not working, how do I verify?

bwooden — Wed, 12 May 2010 16:52:33 GMT

Are you searching for something like this?

index=os source="fschangemonitor" path=*hosts*

Re: fschange, file system change detection not working, how do I verify?

bwooden — Wed, 12 May 2010 17:10:34 GMT

If that search doesn't return results, what Splunk & OS version are you using?