We have most of our environment reporting into Splunk. This includes ESXi hosts, vCenter, Exchange 2007 and several other servers. Currently we only have the Windows Logs (System, Application, Security) reporting in. An example of our inputs.conf file on our vCenter is below:
On this host I would like to start monitoring all the vCenter logs on this host and I believe I can accomplish this by simply monifying the inputs.conf file. The log files I want to monitor are all located here:
These log file names appear to be non-standard and subject to change. Example: (vpxd-15979.log). Is it possible to monitor the entire folder for changes? I have searched for a KB article detailing how to set this up but have come up emtpy, I doubt that I am the first person to try this.