Alerting

How can I detect and be alerted when an app's configuration is changed or modified?

Contributor

For the apps I deploy to clients, I want to be alerted (by e-mail) whenever, for example, "inputs.conf" is changed. fschange is deprecated and I can't find anything in _audit or _internal. What can I use?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi tmontney,

You can
- Monitor file system changes on Windows systems. See http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesystemchangesonWindows .
- Use the auditd daemon on *nix systems and monitor output from the daemon. See https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-sy... .

Hope this helps. Thanks!
Hunter

View solution in original post

Splunk Employee
Splunk Employee

Hi tmontney,

You can
- Monitor file system changes on Windows systems. See http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesystemchangesonWindows .
- Use the auditd daemon on *nix systems and monitor output from the daemon. See https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-sy... .

Hope this helps. Thanks!
Hunter

View solution in original post

Ultra Champion
0 Karma