Getting Data In

Confused about universal forwarding file monitoring

systeminsights
New Member

I have setup a monitor for '/opt/vimana/tenant/*/log/vimana.log'. When I do 'splunk list monitor' I get this:

Monitored Directories:
  /opt/vimana/tenant/*/log/vimana.log
        /opt/vimana/tenant/x1111
        /opt/vimana/tenant/x1111/log
        /opt/vimana/tenant/x2222
        /opt/vimana/tenant/x2222/log
        /opt/vimana/tenant/x3333
        /opt/vimana/tenant/x3333/log
        /opt/vimana/tenant/x4444
        /opt/vimana/tenant/x4444/log
        /opt/vimana/tenant/x5555/log/vimana.log
        /opt/vimana/tenant/x6666
        /opt/vimana/tenant/x6666/log
        /opt/vimana/tenant/x7777
        /opt/vimana/tenant/x7777/log

I don't understand this at all. Every one of these log directories contains a file called 'vimana.log', but only one is listed above and for that tenant it does not list the directories. All of the files are being appended to by apps, but nothing gets forwarded to storm.

How can I debug this? Does splunk have any local log files that I can check to see what's really doing?

Tags (1)
0 Karma

systeminsights
New Member

I think I have an answer. For all of the above I had not yet opened the firewall to storm. Once I did that using the original wildcard every tenant showed a log file being monitored (albeit under the directories section).

As to my other question, how to monitor what the forwarder was doing:

$SPLUNK/var/log/splunk/splunkd.log

0 Karma

systeminsights
New Member

Hmm, so I executed the following

$ splunk add monitor /opt/vimana/tenant/x7777/log/vimana.log

And now the list monitor looks like:

Monitored Directories:
    /opt/vimana/tenant/x7777/log/vimana.log
Monitored Files:
    /opt/vimana/tenant/*/log/vimana.log

And I thought was confused before...

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...