topic Inputs.conf - separate monitors for sub-directories in Getting Data In

Inputs.conf - separate monitors for sub-directories

cramasta — Fri, 11 Jan 2013 20:00:12 GMT

Seeing if you could help me understand why these settings don’t work as I am expecting them to. I have the two monitoring stanza’s in my inputs.conf
If I have just monitor 1 enabled it works fine. As soon as I enable monitor 2 it seems to override monitor 1 and causes monitor 1 not to work anymore. It seems like when I enable monitor 2 it puts into effect the recursive=false which would include the directory that I want monitor 1 to watch. I thought the monitoring stanzas operated independently of each other?

monitor 1: This should monitor all files in the DEFAULT directory but not go recursively in to other directories

[monitor://\\server1\c$\Temp\Log\DocumentCacheListener\DEFAULT]
disabled = false
followTail = 0
index = apollo
sourcetype = default
ignoreOlderThan = 1d
crcSalt = 
recursive = false

*monitor 2: * this should monitor all files in the DocumentCacheListener directory and not go recursively into other directories.

[monitor://\\server2\c$\Temp\Log\DocumentCacheListener]
disabled = 0
followTail = 0
sourcetype = listener
ignoreOlderThan = 1d
crcSalt = 
recursive = false

Re: Inputs.conf - separate monitors for sub-directories

tgow — Fri, 11 Jan 2013 20:56:51 GMT

I would recommend that you run the following command to see if there are any errors:

./splunk cmd btool inputs list --debug

Re: Inputs.conf - separate monitors for sub-directories

cramasta — Fri, 11 Jan 2013 21:18:40 GMT

no noticeable errors in the output.

Re: Inputs.conf - separate monitors for sub-directories

MSimon — Tue, 15 Jan 2013 12:21:37 GMT

I've got the same problem.

If you enable monitor 2 the property recursive = false prevents to monitor the path under monitor 1.

Check the URL 'https://:8089/services/admin/inputstatus/TailingProcessor%3AFileStatus'

Look at the directory ...\Temp\Log\DocumentCacheListener\DEFAULT
If type is "ignored item (recursion disabled)" it's the evidence

Re: Inputs.conf - separate monitors for sub-directories

cramasta — Wed, 27 Feb 2013 16:41:42 GMT

Here is what I had to do in order to get this to work. Involved using a inputs.conf/props.conf combination

inputs.conf

this tells splunk to monitor the directory and all subdirectories

[monitor://\\uslibintv27\c$\Temp\Log\DocumentCacheListener\]
disabled = 1
followTail = 0
host = uslibintv27
index = apollodev

props.conf

I then define my sourcetypes by creating matching source stanzas in the props.conf'

[source::...\\DocumentCacheListener\\*log]
NO_BINARY_CHECK = 1
pulldown_type = 1
sourcetype=listener`

[source::...\\DocumentCacheListener\\DEFAULT\\*log]
NO_BINARY_CHECK = 1
pulldown_type = 1
sourcetype=default

Re: Inputs.conf - separate monitors for sub-directories

elof — Mon, 10 Mar 2014 18:07:02 GMT

Not really an answer (since I think this is a bug), but here's how I did a workaround for a simillar scenario:
http://answers.splunk.com/answers/126064/bug-in-universal-forwarder-inputsconf-monitor-and-recursive-false/126243