topic Re: File Integrity Monitoring - Splunk 6 in Getting Data In

File Integrity Monitoring - Splunk 6

dgavic — Tue, 19 Nov 2013 16:06:00 GMT

With FSChnage being deprecated in Splunk 5.0, what is the best method in Splunk 6 to monitor folder/file changes?

Thank you

Re: File Integrity Monitoring - Splunk 6

dgavic — Wed, 20 Nov 2013 15:47:21 GMT

I did find this write up in the docs section, and this helped get me going in the right direction.

http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorfilesystemchangesonWindows

I am always open for more suggestions, or an easier way to do this.

Thank you

Re: File Integrity Monitoring - Splunk 6

IT_Bullgod — Thu, 16 Jan 2014 22:21:43 GMT

The term Deprecation is misleading many of our customers. The fact remains - Splunk continues to maintain a file integrity checking feature through ver 5 and into the current version. See the link below:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem

Re: File Integrity Monitoring - Splunk 6

IT_Bullgod — Thu, 16 Jan 2014 22:22:27 GMT

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem

Re: File Integrity Monitoring - Splunk 6

Hooshiar — Sun, 14 Jul 2024 06:08:44 GMT

Hello

The link is for version 6.0 and no longer exists.

"http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem"

You can use this link instead:
https://docs.splunk.com/Documentation/Splunk/9.2.2/Data/Monitorchangestoyourfilesystem
Although the contents of this document did not match the solution I wanted
In the SIM solution of ManageEngine company, it is possible to monitor a folder that has been Shared in such a way that if a file or folder is created, edited, renamed or deleted, it shows by which user and at what time and from which IP It happened.
I am looking for such a solution in Splunk

Re: File Integrity Monitoring - Splunk 6

PickleRick — Sun, 14 Jul 2024 09:23:39 GMT

1. It's a veeeeeery old thread (over 10 years since last post)

2. Monitoring changes to filesystem is a completely different issue than logging changes on a file sharing platform (regardless of whether we're talking NFS, CIFS, DAV...). First thing would be to make sure that the service itself can and will log relevant data.