topic Re: Monitor Linux Directory in Getting Data In

Monitor Linux Directory

hartfoml — Wed, 22 Feb 2012 19:05:55 GMT

I am using this stanza to monitor Linux directory

[monitor:///opt/nessus/var/nessus/users/*/reports/]
disabled = 0
followTail = 0
crcSalt =
whitelist = .nessus$
ignoreOlderThan = 30d
index = nessus
sourcetype = nessus

I get this error in the splunkd.log file on the U.F.

'02-22-2012 12:54:31.053 -0600 ERROR TailingProcessor - matching /opt/nessus/var/nessus/users/mikeh/reports/ against ^/opt/nessus/var/nessus/users/[^/]*/reports/$'

I also get the same error on other folders in the users directory. I have tried using the standard stanza like this, [monitor:///opt/nessus/var/nessus/users/.../reports/] but i get the same error messages

I had thought it was due to permissions but I fixed that problem.

Anyone know why I am getting errors on all the folders including the one I want to monitor?

Re: Monitor Linux Directory

lguinn2 — Thu, 23 Feb 2012 01:11:54 GMT

[monitor:///opt/nessus/var/nessus/users/.../reports/]

is the proper syntax.

Re: Monitor Linux Directory

jgedeon120 — Thu, 23 Feb 2012 04:01:59 GMT

If the full path is /opt/nessus/var/nessus/users/username/reports/report_name.nessus
Then it should be [monitor:///opt/nessus/var/nessus/users/*/reports] The * is for single directory depth where ... is one or more directories. So remove your trailing slash.

Re: Monitor Linux Directory

hartfoml — Thu, 23 Feb 2012 14:05:22 GMT

you might be right. I tried just commenting out the whitelist item the 'whitelist = *.nessus'
it looks like this worked so I think the problem may be in the combo or the final directory name and the whitelist format

Re: Monitor Linux Directory

hartfoml — Thu, 23 Feb 2012 14:05:55 GMT

sorry 'whitelist = *\.nessus'

Re: Monitor Linux Directory

lguinn2 — Thu, 23 Feb 2012 19:08:35 GMT

should be

whitelist=.*\.nessus$

if you want to match only pathnames that end in .nessus

Re: Monitor Linux Directory

jgedeon120 — Fri, 24 Feb 2012 10:42:50 GMT

whitelist = *.nessus$

Re: Monitor Linux Directory

ujju219 — Fri, 11 Nov 2022 09:07:47 GMT

what could be the stanza for monitoring linux directory

/home/cleo/Harmony/script/logs/Harmony_directory_monitor_1hr.conf.20220512.log

i tried [monitor:///home/cleo/Harmony/script/logs] with whitelist =*.log