topic Re: fsmonitor question in Getting Data In

fsmonitor question

diegosainz — Mon, 22 Apr 2013 15:24:52 GMT

Is it possible for a file monitored with fsmonitor to send an alert on any difference of the file? or would monitoring the file be able to provide that visibility.

Re: fsmonitor question

rnolette — Mon, 22 Apr 2013 16:50:05 GMT

if fsmonitor has a log file that generates events on file status changes then you can write a custom file monitor that will send the events to the splunk server. You then can create a realtime query Alert that will email you every time this event is triggered. I did this for checking when someone changes something on one of my servers that has a custom application on it.

Re: fsmonitor question

diegosainz — Mon, 22 Apr 2013 18:56:56 GMT

We have done that, we would like to know what has changed in the file.

Re: fsmonitor question

rnolette — Mon, 22 Apr 2013 19:04:01 GMT

oh. well you didn't say that. Does the file monitor not read in the file when it alerts you? I dont think you can do diff change monitoring from splunk. youd need a diff application to push the new copy to and the old copy then have splunk alert on what the diff application said changed. That would tell you but is a bunch of work. If the device is a network appliance, just use puppet or Cacti.

Re: fsmonitor question

diegosainz — Tue, 23 Apr 2013 14:34:59 GMT

Thank you. I will do that.