How can I detect and be alerted when an app's configuration is changed or modified?

[tmontney]

For the apps I deploy to clients, I want to be alerted (by e-mail) whenever, for example, "inputs.conf" is changed. fschange is deprecated and I can't find anything in _audit or _internal. What can I use?

[hunters_splunk · Accepted solution]

Hi tmontney,

You can
- Monitor file system changes on Windows systems. See http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/MonitorfilesystemchangesonWindows .
- Use the auditd daemon on *nix systems and monitor output from the daemon. See https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/chap-sy... .

Hope this helps. Thanks!
Hunter

[ddrillic]

There should be something similar to the following - Splunk App for AWS: How to create an alert to trigger every time the amount of security group rules ...