topic Re: Blacklisting directories without read permission in Getting Data In

Blacklisting directories without read permission

_smp_ — Wed, 23 Aug 2017 20:27:30 GMT

Hi. I have configured a 6.5.3 Linux Universal Forwarder with an inputs.conf like this:

[monitor:///www/*/logs/access_log*]
disabled = 0
index = web
sourcetype = access_combined
crcSalt = <SOURCE>
blacklist = \.gz$|lost\+found

I am trying to blacklist a directory named '/www/lost+found' because the splunk user does not have read-permission to this directory. But the blacklist regex isn't working because I am still seeing a WARN FilesystemChangeWatcher - error reading directory "/www/lost+found": Permission denied error in the _internal log. It seems to be ignoring .gz files as I would expect. Is this an issue with the regex? Or is this more of an order-of-operations type of situation where it needs to read the directory before processing the blacklist?

Re: Blacklisting directories without read permission

gcusello — Thu, 24 Aug 2017 08:33:32 GMT

Hi scottprigge,
try to use blacklist = lost\+found
and then restart Splunk on Forwarder.
Bye.
Giuseppe

Re: Blacklisting directories without read permission

_smp_ — Thu, 24 Aug 2017 12:25:07 GMT

Sorry, maybe I misunderstood something. But I already have that exact blacklist regex included in the stanza of my original post. The difference is that I also need to exclude files ending with a .gz extension so my regex looks like \.gz$|lost\+found

Re: Blacklisting directories without read permission

gcusello — Fri, 25 Aug 2017 08:49:16 GMT

Sorry I misunderstood,
try with

blacklist = \.gz$|lost\+found.

Bye.
Giuseppe

Re: Blacklisting directories without read permission

_smp_ — Fri, 25 Aug 2017 14:39:54 GMT

No, that doesn't seem to have made any difference.

Re: Blacklisting directories without read permission

woodcock — Fri, 25 Aug 2017 15:10:17 GMT

Try this:

 blacklist = \.gz$|(lost\+found)

Re: Blacklisting directories without read permission

_smp_ — Fri, 25 Aug 2017 17:40:56 GMT

Unfortunately no, that didn't work either.