topic Re: How to monitor a folder in Windows ? C:\Windows\assembly in Getting Data In

How to monitor a folder in Windows ? C:\Windows\assembly

chimbudp — Tue, 19 Feb 2013 06:43:56 GMT

I would like to monitor assembly folder in windows.
Path :- C: \Windows \assembly

I have set the inputs.conf in Universal forwarder as below:

[monitor://path]
disabled = 0
interval= 00
index = Assemby_monitor
fullEvent = true

I have received no data under the Assembly_monitor index .
Do i need to set any other properties ?
Please help

Re: How to monitor a folder in Windows ? C:\Windows\assembly

MHibbin — Tue, 19 Feb 2013 09:47:05 GMT

Hi,

You should check the docs for this file, here.

Firstly, I would just set the directory in the stanza, like this:

[monitor://C:\Windows\assembly]

Secondly, you do not require the "interval" parameter, this is for the Script and Perfmon stanzas.

Thirdly, you do not require the "fullEvent" parameter, this is for the FSChange stanza which is deprecated (as v5).

The following is probably what you want:

[monitor://C:\Windows\assembly]
index=Assembly_monitor

To confirm, are you searching with index="Assembly_monitor"? This will be required, unless you allow users to search across this index by default.

Hope this helps

Re: How to monitor a folder in Windows ? C:\Windows\assembly

Ayn — Tue, 19 Feb 2013 10:19:49 GMT

What do you mean by that you want to monitor the assembly directory? This directory mainly consists of binary files, so I'm assuming you don't want to actually index their contents...?

Re: How to monitor a folder in Windows ? C:\Windows\assembly

chimbudp — Mon, 28 Sep 2020 13:20:46 GMT

[monitor://C:\Windows\assembly]
index=Assembly_monitor

the above stanza forwards no data into Splunk indexer.

i have set the source type as assembly and modified as below inputs.conf:
[monitor://C:\Windows\assembly]
index=Assembly_monitor
sourcetype=Assembly

and edited props.conf as :

[Assembly]
NO_BINARY_CHECK = true

-- Even also i am not getting any data 😞
Please help

Re: How to monitor a folder in Windows ? C:\Windows\assembly

chimbudp — Mon, 28 Sep 2020 13:20:52 GMT

I can able to get the data into Splunk after i set the props.conf :
[Assembly]
NO_BINARY_CHECK = true

Now ,i am getting all the binary data - how can i get the relevant fields ?
Like Assembly name, date created , Version ., etc.

Re: How to monitor a folder in Windows ? C:\Windows\assembly

Ayn — Tue, 19 Feb 2013 14:33:43 GMT

You're going about this the wrong way. See answers to previous questions (asked by you...):

http://splunk-base.splunk.com/answers/75630/how-to-monitor-assembly-folder-in-windows
http://splunk-base.splunk.com/answers/75697/to-monitor-a-file-directory-via-forwarder

Re: How to monitor a folder in Windows ? C:\Windows\assembly

chimbudp — Mon, 28 Sep 2020 13:20:57 GMT

Hello Ayn,

inputs.conf as in Universal forwarder:

[monitor://C:\Windows\assembly]
disabled = 0
index = Assembly_Monitor
sourcetype = assembly_logs

props.conf in UF & indexer :

[assembly_logs]
KV_MODE = xml

But , i am not getting any data into Splunk now .

Re: How to monitor a folder in Windows ? C:\Windows\assembly

Ayn — Tue, 19 Feb 2013 16:06:21 GMT

No, because you're using a monitor input, not fschange. By default Splunk will not read binary files because, well, they're binary and not very useful to work with in Splunk. You should use fschange.

Re: How to monitor a folder in Windows ? C:\Windows\assembly

Drainy — Wed, 20 Feb 2013 08:45:58 GMT

Ayn is trying to help below, you're best replying with actual detail and problems to his responses rather than starting a new question each time you have a reply 🙂