topic Re: Unathorized Linux folder deletion in Splunk Search

Unathorized Linux folder deletion

ajeeshneelamkav — Wed, 10 Dec 2014 06:20:08 GMT

Hi All,

I am new to Splunk and need to complete the below use case

Files in a linux directory are regularly archived to different directory. File deletion in this directory needs to be monitored.

Example directory: user/data/files on a Linux machine
Splunk ver:6.1

Re: Unathorized Linux folder deletion

kml_uvce — Wed, 10 Dec 2014 07:08:52 GMT

use this in inputs.conf
[fschange:<path>]

http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

Re: Unathorized Linux folder deletion

Ayn — Wed, 10 Dec 2014 08:00:43 GMT

fschange is deprecated. Recommended option is to use each OS's native mechanisms for auditing filesystem activity, like auditd in Linux.

Re: Unathorized Linux folder deletion

kml_uvce — Wed, 10 Dec 2014 08:12:43 GMT

Hi Ayn

I am not seeing fschange is deprecated in latest version 6.2 http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

please correct me If I am wrong...

Re: Unathorized Linux folder deletion

ajeeshneelamkav — Wed, 10 Dec 2014 10:38:48 GMT

I have done it, how can retrieve this particular change using search query to create an alert ?

Re: Unathorized Linux folder deletion

ajeeshneelamkav — Wed, 10 Dec 2014 10:59:33 GMT

if a folder deletes from Linux or files deleted from a Linux folder, will be there any specific keyword?

Re: Unathorized Linux folder deletion

kml_uvce — Wed, 10 Dec 2014 11:00:20 GMT

how you done it , by using fschange /?
see keywords related to you deletion event and write search :

index=<indexname> "keywords" and then go to save as-> alert

Re: Unathorized Linux folder deletion

kml_uvce — Wed, 10 Dec 2014 11:12:38 GMT

see in your events or send any event...

Re: Unathorized Linux folder deletion

Ayn — Wed, 10 Dec 2014 12:02:04 GMT

http://docs.splunk.com/Documentation/Splunk/6.2.0/releasenotes/Deprecatedfeatures

Re: Unathorized Linux folder deletion

kml_uvce — Wed, 10 Dec 2014 12:11:50 GMT

hmmm, usually splunk gives any deprecated features in conf files also, but they have not given in inputs.conf for fschange, they need to change the doc for inputs.conf...

Re: Unathorized Linux folder deletion

Ayn — Wed, 10 Dec 2014 13:26:48 GMT

No, "deprecated" does not mean "removed". The functionality is still there, but is due for removal, and the recommendation is to explore other options instead.

Re: Unathorized Linux folder deletion

kml_uvce — Wed, 10 Dec 2014 13:36:10 GMT

yeah i am saying that splunk always mentioned that features is deprecated in conf files doc also but here splunk has not mentioned