topic Re: tuning of file monitoring in Getting Data In

tuning of file monitoring

vinchakov_a — Tue, 18 Mar 2014 05:37:48 GMT

Good afternoon, I try monitoring of files. Version of Splunk is 6 . I faced unclear problems for me:
1) How to monitor new files and deleting files?
2) I created the filter but it doesn't work?
3) How to switch off actuating on change of time of the file?

[filter:blacklist:ignore_logs]
regex1 = *.log$
regex2 = *.LOG$

[fschange:C:\Windows\System32]
pollPeriod = 360
filter = ignore_logs
signedaudit = false
hashMaxSize = 10240
recurse = true
followLinks = true
fullEvent = true
sendEventMaxSize = -1
filesPerDelay = 100
delayInMills = 100

And it permanently repeats in logs:

Tue Mar 18 11:32:45 2014 action=update, path="C:\Windows\System32\config\SYSTEM.LOG1", isdir=0, size=262144, gid=-1, uid=-1, modtime="Tue Mar 18 11:28:59 2014", mode="rwxrwxrwx", hash=, chgs="modtime "
Tue Mar 18 11:32:45 2014 action=update, path="C:\Windows\System32\config\SYSTEM", isdir=0, size=13631488, gid=-1, uid=-1, modtime="Tue Mar 18 11:28:59 2014", mode="rwxrwxrwx", hash=, chgs="modtime "

Re: tuning of file monitoring

MuS — Tue, 18 Mar 2014 07:14:19 GMT

Hi vinchakov_a,

let me try to answer this:

1) How to monitor new files and deleting files?

this can be done by using the batch input like this

[batch://<path>]
* One time, destructive input of files in <path>.

2) I created the filter but it doesn't work?

Your regex *.log$ or *.LOG$ do not match the file "C:\Windows\System32\config\SYSTEM.LOG1" because you are searching for files containing a literal * and ending with either .log or .LOG. Try to use some thing like this to match also logs containing numbers

regex1 = .log(\d+)
regex2 = .LOG(\d+)

3) How to switch off actuating on change of time of the file?

I don't fully understand what you mean, so I will not provide an answer....

hope this helps ...

cheers, MuS

Re: tuning of file monitoring

vinchakov_a — Tue, 18 Mar 2014 07:57:55 GMT

Thanks, I will try your regex. But I think batch it not that it is necessary for me. It is necessary for me that splunk reported when in the folder there is a new file or the old is deleted.

Re: tuning of file monitoring

vinchakov_a — Wed, 19 Mar 2014 07:13:29 GMT

Regex not work...

Re: tuning of file monitoring

MuS — Wed, 19 Mar 2014 07:22:34 GMT

you can try .log or .LOG as well

Re: tuning of file monitoring

vinchakov_a — Wed, 19 Mar 2014 07:33:21 GMT

I found mistake:
filterS = ignore_logs

Re: tuning of file monitoring

MuS — Wed, 19 Mar 2014 07:37:15 GMT

good one, but remember it will be a lower s