fschange generates false update events

kkuminsky — Fri, 11 Jun 2010 02:35:31 GMT

I've set up file monitoring with fschange:

[fschange:C:\TEMP\test.txt]
index = main
recurse = false
followLinks = false
signedaudit = false
fullEvent = false
sendEventMaxSize = 1048576
delayInMills = 1000
pollPeriod = 60

What's happening is that every 60 seconds it generates update event. File is not modified. Modified time in all these events is the same.

6/10/10 3:28:09.000 PM Thu Jun 10 15:28:09 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime "

6/10/10 3:27:08.000 PM Thu Jun 10 15:27:08 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime "

6/10/10 3:26:07.000 PM Thu Jun 10 15:26:07 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime "

6/10/10 3:25:06.000 PM Thu Jun 10 15:25:06 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime "

6/10/10 3:24:05.000 PM Thu Jun 10 15:24:05 2010 action=update, path="C:\TEMP\test.txt", isdir=0, size=11, gid=-1, uid=-1, modtime="Thu Jun 10 15:10:32 2010", mode="rwxrwxrwx", hash=, chgs="modtime "

Any thoughts why it's happening?

Re: fschange generates false update events

maverick — Thu, 19 May 2011 13:08:29 GMT

This does not seem normal behavior for an fschange input.

Couple questions:

1) What version of Splunk are you running?

2) What version of Windows are you running Splunk on?

Also, try changing your file path to be the parent directory, instead of the test.txt file, like this and see if that makes any difference:

[fschange:C:\TEMP]

topic fschange generates false update events in Getting Data In

fschange generates false update events

Re: fschange generates false update events