Monitor a file in a folder

anandhalagarasa — Fri, 18 May 2018 06:20:03 GMT

Hi Team,

We have an requirement to monitor the files is getting deleted or modified or added into a folder then we need to get an splunk alert stating that who has modified the file or deleted the folder.

Consider an example:

We have an shared Drive (D) in a windows server in that we have multiple folders like (A),(B) and (C). In that when we go to folder (A) inside there would be multiple files (might be log file or any other files) like x.log, y.csv and z.xlsx.

So we want to get notified if any of the files say (x.log) is getting deleted or modified in that particular folder (A) and we want to know who has deleted or modified the file.

Is it possible to achieve in Splunk?

If yes kindly let me know how to proceed the same.

Re: Monitor a file in a folder

mayurr98 — Fri, 18 May 2018 06:40:38 GMT

for that, I think you would need to index audit file logs into Splunk.
Refer this blog to turn on object access auditing.
See if this helps

detect any file that has been deleted (gone from the server, not moved to a sub-directory or something)
Event Code=4663 AND Accesses= DELETE AND Object Type=File
detect any modification made to a file
Event Code=4663 AND Accesses= WriteData AND Object Type=File
detect any readings on files
http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/

let me know if this helps!

topic Monitor a file in a folder in Monitoring Splunk

Monitor a file in a folder

Re: Monitor a file in a folder