topic Re: Using fschange to monitor files on linux server from windows splunk server in Getting Data In

Using fschange to monitor files on linux server from windows splunk server

tasdienes — Wed, 06 Jul 2011 04:22:20 GMT

I have splunk running on windows. I want to monitor the /etc directory on a linux server with fschange. Is that possible?

How would I specify the path? [fschange://servername/etc] ?

How should I enable splunk (which runs under a Windows AD domain account) to read the files on the linux server? I could share them with samba, but splunk wouldn't know how to handle the login credentials...

Re: Using fschange to monitor files on linux server from windows splunk server

mzorzi — Wed, 06 Jul 2011 12:07:29 GMT

You might want to install a light forwarder in the linux server, sending the data to the Windows Indexer.

You can even decide to use a cross filesystem solution like samba, but I believe you will encounter all sorts permissions and performance problems

Re: Using fschange to monitor files on linux server from windows splunk server

tasdienes — Wed, 06 Jul 2011 16:40:43 GMT

Thanks, I'll give that a try.