topic Re: fschange output in Getting Data In

fschange output

heterodyned — Sun, 11 Jul 2010 15:33:44 GMT

I have set up the following fschange for a test, in a test-box

[filter:blacklist:sys-folder-blacklist]
regex1=/sys/block/*
regex2=/sys/devices/system/*
regex3=/sys/module/*
regex4=/sys/devices/platform/*

[fschange:/sys]
index = _audit
sourcetype = fschange
signedaudit = false
sendEventMaxSize = -1
recurse = true
disabled = false
pollPeriod = 86400
filesPerDelay = 10
delayInMills = 100
followLinks = false
fullEvent = false
hashMaxSize = -1
filters=sys-folder-blacklist

It still shows me some events with path related to the black list filter and the action is action=delete-parent

Could someone explain me, if this takes place only for the initial indexing?

-raghu

Re: fschange output

heterodyned — Sun, 11 Jul 2010 15:35:56 GMT

Also I forgot to say that,

I have two copies of the input.conf one in etc/system/local
and other in /etc/apps/search/local

Is it because it cud be passing the search due to precedence?

Re: fschange output

heterodyned — Mon, 12 Jul 2010 21:20:51 GMT

Update...the filters dont seem to work, they are still indexing data from those folders

Re: fschange output

balt — Thu, 11 Nov 2010 07:20:46 GMT

I am having a similar issue and would like to see a response. Anyone?

Re: fschange output

heterodyned — Thu, 11 Nov 2010 18:56:30 GMT

Balt,
I havent yet received a response on why those events come in, but after you implement the filters, it does show events of action=delete only once after the fil4ers are applied. I presume it is remove those indexing IDs from splunk which was previously created for the particular path

Re: fschange output

Takajian — Thu, 25 Nov 2010 08:26:31 GMT

I also have faced same issue before, and I have heard from support team that there is known issue when we use blacklist. So, you may need to ask support team to solve the issue.

Re: fschange output

heterodyned — Thu, 25 Nov 2010 15:28:16 GMT

Oh is it? could it be the regex in use that maybe causing these delete events? I shall get in touch with the support team to verify, I did observe that after the delete events, the implemented black-list filter works fine. Thanks Sasaki I shall get in touch with support team to resolve this issue 🙂