https://community.splunk.com/t5/Getting-Data-In/Is-monitoring-conf-files-on-forwarders-any-different-from/m-p/415002#M73376 <P>Thanks and thanks.</P> Tue, 05 Mar 2019 18:04:28 GMT swagner1965 2019-03-05T18:04:28Z https://community.splunk.com/t5/Getting-Data-In/Is-monitoring-conf-files-on-forwarders-any-different-from/m-p/415000#M73374 <P>We want to watch the /local .conf files on our forwarders and alert if changes are made. Is this as simple as setting up the monitoring just like we would for any other files? This is for answering an RMF control.</P> Tue, 05 Mar 2019 15:27:56 GMT https://community.splunk.com/t5/Getting-Data-In/Is-monitoring-conf-files-on-forwarders-any-different-from/m-p/415000#M73374 swagner1965 2019-03-05T15:27:56Z https://community.splunk.com/t5/Getting-Data-In/Is-monitoring-conf-files-on-forwarders-any-different-from/m-p/415001#M73375 <P>Yes, although you should be aware that a deployment server could be pushing config changes to your forwarders.<BR /> If the change is to a lookup/dashboard etc, the app will be redeployed to the forwarder, and the conf files will be replaced even though the content may be unchanged. Just something to watch out for</P> Tue, 05 Mar 2019 16:54:18 GMT https://community.splunk.com/t5/Getting-Data-In/Is-monitoring-conf-files-on-forwarders-any-different-from/m-p/415001#M73375 nickhills 2019-03-05T16:54:18Z https://community.splunk.com/t5/Getting-Data-In/Is-monitoring-conf-files-on-forwarders-any-different-from/m-p/415002#M73376 <P>Thanks and thanks.</P> Tue, 05 Mar 2019 18:04:28 GMT https://community.splunk.com/t5/Getting-Data-In/Is-monitoring-conf-files-on-forwarders-any-different-from/m-p/415002#M73376 swagner1965 2019-03-05T18:04:28Z