https://community.splunk.com/t5/Getting-Data-In/File-and-Directory-Monitoring-with-Splunk/m-p/143949#M29388 <P>Hi all,</P> <P>Since fschange is a deprecated feature post Splunk 5.0, i wwould like to know how to monitor windows and linu files/directories. For windows something comes to mind to enable auditing feature either as a GPO/local policy but nothing on linux. Please let me know what is the best possible approach to do this ?</P> Fri, 15 Nov 2013 07:57:05 GMT lohit 2013-11-15T07:57:05Z https://community.splunk.com/t5/Getting-Data-In/File-and-Directory-Monitoring-with-Splunk/m-p/143949#M29388 <P>Hi all,</P> <P>Since fschange is a deprecated feature post Splunk 5.0, i wwould like to know how to monitor windows and linu files/directories. For windows something comes to mind to enable auditing feature either as a GPO/local policy but nothing on linux. Please let me know what is the best possible approach to do this ?</P> Fri, 15 Nov 2013 07:57:05 GMT https://community.splunk.com/t5/Getting-Data-In/File-and-Directory-Monitoring-with-Splunk/m-p/143949#M29388 lohit 2013-11-15T07:57:05Z https://community.splunk.com/t5/Getting-Data-In/File-and-Directory-Monitoring-with-Splunk/m-p/143950#M29389 <P>For Linux you could use auditd to configure what to audit where, and Splunk the log from /var/log/audit/audit.log.</P> Fri, 15 Nov 2013 12:20:11 GMT https://community.splunk.com/t5/Getting-Data-In/File-and-Directory-Monitoring-with-Splunk/m-p/143950#M29389 martin_mueller 2013-11-15T12:20:11Z