topic Monitoring changes to configuration files in Getting Data In

Monitoring changes to configuration files

kkuminsky — Thu, 10 Jun 2010 03:17:47 GMT

Trying to monitor changes to configuration files.

Followed this article: http://www.splunk.com/base/Documentation/4.0.9/Admin/Monitorchangestoyourfilesystem

Created Data Input in Splunk Manager. Here is the inputs.conf (added pollPeriod manually):

[monitor://\192.168.1.12\Siteroot\Web.config]

disabled = false

host = SIT-APP-shared

host_regex =

host_segment =

index = main

sourcetype =

pollPeriod = 60

Restarted splunk after changes, share has full permissions for everyone.

Then I change web.config file. Do search in Splunk - nothing.

Does the configuration look right? How do I debug it to see if it's connecting to the share, how often, error messages etc.?

Re: Monitoring changes to configuration files

the_wolverine — Thu, 10 Jun 2010 13:28:15 GMT

What you want to do is fschange (filesystem change) monitoring which is different from monitoring. If you modify you configuration to look like that in the example on the page you linked to, it should work:

[fschange:/var/apache] 
index = sample 
recurse = true 
followLinks = false 
signedaudit = false 
fullEvent = true 
sendEventMaxSize = 1048576 
delayInMills = 1000

Re: Monitoring changes to configuration files

kkuminsky — Thu, 10 Jun 2010 21:30:56 GMT

Yes, you are right. It looks like I shouldn't rely that much on GUI.

So, I've changed the config (see below). Now I don't see this record in Splunk Manager under Data Inputs anymore. Also, when I make changes to the file I'm still not able to find any records when doing search.

[fschange:\10.255.1.20\Siteroot\Web.config]

index = main

recurse = true

followLinks = false

signedaudit = false

fullEvent = true

sendEventMaxSize = 1048576

delayInMills = 1000

pollPeriod = 60

Re: Monitoring changes to configuration files

kkuminsky — Thu, 10 Jun 2010 22:23:30 GMT

It appears that it's working for local files - [fschange:C:\TEMP\test.txt], but not for network - [fschange:\10.255.1.20\Siteroot\Web.config]

So, I guess the question is how to monitor files on other machines in the network.

Re: Monitoring changes to configuration files

kkuminsky — Fri, 11 Jun 2010 00:16:54 GMT

OK, the reason it was not working is that Splunk services were running under Local System account.

Here are the articles I used to fix it:

http://www.splunk.com/base/Documentation/latest/Installation/InstallonWindows#Choosing_the_user_Splunk_should_run_as

http://www.splunk.com/base/Documentation/latest/Installation/CorrectingtheuserselectedduringWindowsinstallation