Weird Monitoring issue after AIX Universal Forwarder Upgrade

aknsun — Wed, 20 Nov 2019 07:22:01 GMT

Hi,

We have an issue with an AIX server that just doesn't seem to monitor a particular log file after it was upgraded from v4.3.2 to v6.4.2. All the other logs mentioned in the inputs.conf are working fine. It' just this particular stanza that seems to be having and issue and that too, just on this particular server. Other servers upgraded along with it don't have this issue. And there are no blank spaces or any of that sort. This was cross checked.

Stanza is in the following format.

[monitor:///blah-blah*]
index = abc
host = server1
sourcetype = def

Anyone faced similar issue after AIX UF upgrade?

Thanks,
AKN

Re: Weird Monitoring issue after AIX Universal Forwarder Upgrade

oscar84x — Wed, 20 Nov 2019 19:56:13 GMT

Does the user Splunk is running under have read permissions to the file?
Perhaps it was running under a different user before the upgrade.

If that's not the case are you seeing any specific errors?
You can also run the search below, look at the "file" field, and search for events related to the specific file:

index=_internal component=WatchedFile

topic Re: Weird Monitoring issue after AIX Universal Forwarder Upgrade in Monitoring Splunk

Weird Monitoring issue after AIX Universal Forwarder Upgrade

Re: Weird Monitoring issue after AIX Universal Forwarder Upgrade