topic Re: monitoring changes to a remote filesystem in Getting Data In

monitoring changes to a remote filesystem

kaplan71 — Tue, 20 Jul 2010 03:32:00 GMT

Hi there --

I completed installing the latest version of Splunk on two systems where the first is the server, and the second is the client. The former has been configured to receive data on port 9997 while the latter has been set up to forward data on the same port. Both systems use Linux operating systems.

What I am trying to set up between the two is a file integrity monitoring of the client from the server. I had several questions concerning this:

How can I verify the connection between the server and the client?
What app, script or procedure, if there are any available, can I use to accomplish this task?
What file(s) do I create and/or modify to let Splunk know what files and/or directories I want to monitor for unexpected changes?

Thanks.

Re: monitoring changes to a remote filesystem

Genti — Tue, 20 Jul 2010 06:07:21 GMT

1 - If you are monitoring anything at all on the forwarder then you should (theoretically) see it immediately as you log on to your indexer on the search dashboard (this is assuming you are sending it to a visible index) . If you know you have data being monitored on the forwarder then try searching on the receiver for host= (make sure you use the forwarder's name)

2(+3) - Read the documentation on fschange and see if this is what you had in mind:
http://www.splunk.com/base/Documentation/4.1.4/Admin/Monitorchangestoyourfilesystem
Possibly, you are going to monitor the data on the forwarder and send it to the receiver. Let me know if more help is needed or if i have misunderstood your question (or if what i suggested doesnt work for ya )

Cheers,
.gz

Re: monitoring changes to a remote filesystem

kaplan71 — Tue, 20 Jul 2010 21:52:12 GMT

Hi there --

I believe the connection between the server and client has been established. Listed below is an excerpt:

7/20/10
10:17:20.000 AM

localhost - - [20/Jul/2010:10:17:20 -0400] "POST / HTTP/1.1" 200 129 CUPS-Get-Classes client-error-not-found

* host=Hadron   Options|  
* sourcetype=cups_access   Options|  
* source=/var/log/cups/access_log

The only thing that I am confused about is the mention of the localhost. Does that mean the readout is actually from the Splunk server, or is the information actually coming from the Hadron client system?