topic Re: Monitor Who has made a change to a file in Getting Data In

Monitor Who has made a change to a file

AaronMoorcroft — Wed, 17 Apr 2013 14:39:25 GMT

Hey Guys

A simple one for someone out there im sure, I have a file on 3 servers that I currently monitor the changes to with Splunk, I have been asked to monitor the said files for the change and also the user account that makes the change, can anyone advise on how to do this ?

Re: Monitor Who has made a change to a file

kristian_kolb — Wed, 17 Apr 2013 14:50:17 GMT

You'll probably need to set up the auditing functions for your OS in question. (Typically auditd for Linux and enabling the Object Access audit policy on Windows).

Splunk used to have a function for this, well it's actually still there, but it's been deprecated in version 5.x. This solution (fschangemonitor) can not however detect WHO made changes to a file.

Hope this helps,

Kristian

Re: Monitor Who has made a change to a file

AaronMoorcroft — Thu, 18 Apr 2013 07:50:52 GMT

thats a great help, thanks for your advice.

Re: Monitor Who has made a change to a file

necrophobic — Wed, 16 Oct 2013 16:19:38 GMT

can splunk detect which line of the file was change and what was the changes like what the diff command does?

Re: Monitor Who has made a change to a file

kristian_kolb — Thu, 17 Oct 2013 19:59:46 GMT

Well, I believe that there is/was an optional attribute called fullEvent (boolean), that would toggle whether splunk should index the contents of the file being audited.

If I remember correctly this did not really work all that well when I tried it last - on *nix the whole file came in as one event, and on Windows, each line of the file became a separate event (or if it was the other way round). But this was back in the 4.x days...