What is the correct method to consume symlinks?

justinbarta — Wed, 04 Oct 2017 14:48:44 GMT

Hi,

I'm attempting to consume MSSQL ERROR logs from 800+ systems with different log locations.

The current approach is to configure a common directory on the C drive c:\mssql logs\ with up to 10 symlink links within.
Each link corresponds to LOG folders of different MSSQL Instances.

C:\MSSQL LOGS\LOG1
C:\MSSQL LOGS\LOG2
C:\MSSQL LOGS\LOG3 ... etc

For example symlink LOG1 points to C:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Log

My current inputs.conf is not working however one that points to the actual does.

I need 2 questions answered.
1. What is the correct method to consume symlinks
2. Is there a better approach to deploy & consume MSSQL ERROR logs from a large amount of systems.
Thanks

[monitor://C:\MSSQL LOGS*] - Does not work
[monitor://C:\MSSQL LOGS\LOG4*] - Does not work

inputs.conf

[monitor://C:\MSSQL LOGS*]
followSymlink = true
recursive = true
index = stage_idx
sourcetype = mssql:errorlog
disabled = 0

Re: What is the correct method to consume symlinks?

justinbarta — Wed, 25 Oct 2017 20:52:55 GMT

bump......

Re: What is the correct method to consume symlinks?

gcusello — Thu, 26 Oct 2017 07:22:12 GMT

Hi
did you tried to use SQL Server TA ( https://splunkbase.splunk.com/app/2648/ )?

Bye.
Giuseppe

topic Re: What is the correct method to consume symlinks? in Getting Data In

What is the correct method to consume symlinks?

Re: What is the correct method to consume symlinks?

Re: What is the correct method to consume symlinks?