Monitoring Splunk

fschange monitoring /root/.ssh/authorized_keys2

JasonCzerak
Explorer

So I'm at a loss here.

.bashrc and .bash_profile are picked up just fine. however I can't get authorized_keys2 to be picked up unless I do something like /root/.ssh/* I wish to avoid known_hosts. I've tried just about everything can think of. What's weird is /root/.ssh/authorized_keys2 it self fails.

Ideas?

[fschange:/root/]
filters = root_wl,all_bl
fullEvent = true

[filter:whitelist:root_wl]

Key root files that should never change

regex1 = [^/]authorized_keys2
regex2 = [^/]
.bash_profile
regex3 = [^/]*.bashrc

[filter:blacklist:all_bl]
regex1 = .?

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi JasonCzerak

do you get any error in splunkd.log about this?
What happens if you add the file monitor in the UI Manager?

cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...