WinRegMon - Inputs.conf works on localhost but not on universal forwarder.

VasukiPramod — Mon, 10 Aug 2020 03:40:04 GMT

Hi Team,
The following inputs.conf works on localhost to monitor a registry key, but not working on the universal forwarder.

[WinRegMon://HKLM]
baseline=1
disabled=0
hive=\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.*
index=windows
proc=.*
type=set|create|delete|rename

BTW even the following hive attribute too works fine on local host but not on universal forwarder

hive=HKEY_LOCAL_MACHINE\\SYSTEM\\*ControlSet*\\Services\\LanManServer\\Shares\\?.*

But the default configuraiton of inputs.conf works on both local host and the universal forwarder.

[WinRegMon://default]
disabled = 0
hive = .*
proc = .*
type = rename|set|delete|create
index = windows

Any references are much helpful.

topic WinRegMon - Inputs.conf works on localhost but not on universal forwarder. in Getting Data In

WinRegMon - Inputs.conf works on localhost but not on universal forwarder.