FSCHANGE recurse issue

chaben — Mon, 28 Sep 2020 16:39:27 GMT

Hello,

I want to watch .so .bin files in the /etc/security and its subfolders.

I applied a whitelist filter and a blacklist filter:

[filter:whitelist:whitelist_f]
regex1 = (.+.so$|.+.bin$)
[filter:blacklist:blacklist_f]
regex1 = .*

Paramètres du File System Change Monitor pour le dossier /etc

[fschange:/etc/security/]
recurse = true
filters = whitelist_f,blacklist_f

Result : i can see the .so and .bin on /etc/security and not in the subfolders.

I guess that fschange apply the filters on the subfolders name too.
I tried to write some regex to include some subfolders but i dont get the waited result.

example of tried regex :

regex1 = ^/etc/security/*/(.+.so$|.+.bin)$

regex1 = ^/etc/security/.../(.+.so$|.+.bin)$

regex1 = ^/etc/security/(.+.so$|.+.bin)$

Any idea is welcome,

Thanks in advance,

Chaben

Re: FSCHANGE recurse issue

lukejadamec — Mon, 19 May 2014 15:05:42 GMT

I believe you need to make the change in the source, not the regex:

[fschange:/etc/security/...]

Re: FSCHANGE recurse issue

chaben — Tue, 20 May 2014 08:32:45 GMT

Thanks for your reply lukejadamec, i tried on Splunk Enterprise 6 but it doesn't work: No file added.

topic Re: FSCHANGE recurse issue in Getting Data In

FSCHANGE recurse issue

Paramètres du File System Change Monitor pour le dossier /etc

regex1 = ^/etc/security/*/(.+.so$|.+.bin)$

regex1 = ^/etc/security/.../(.+.so$|.+.bin)$

regex1 = ^/etc/security/(.+.so$|.+.bin)$

Re: FSCHANGE recurse issue

Re: FSCHANGE recurse issue