Getting Data In

Confused about universal forwarding file monitoring

systeminsights
New Member

I have setup a monitor for '/opt/vimana/tenant/*/log/vimana.log'. When I do 'splunk list monitor' I get this:

Monitored Directories:
  /opt/vimana/tenant/*/log/vimana.log
        /opt/vimana/tenant/x1111
        /opt/vimana/tenant/x1111/log
        /opt/vimana/tenant/x2222
        /opt/vimana/tenant/x2222/log
        /opt/vimana/tenant/x3333
        /opt/vimana/tenant/x3333/log
        /opt/vimana/tenant/x4444
        /opt/vimana/tenant/x4444/log
        /opt/vimana/tenant/x5555/log/vimana.log
        /opt/vimana/tenant/x6666
        /opt/vimana/tenant/x6666/log
        /opt/vimana/tenant/x7777
        /opt/vimana/tenant/x7777/log

I don't understand this at all. Every one of these log directories contains a file called 'vimana.log', but only one is listed above and for that tenant it does not list the directories. All of the files are being appended to by apps, but nothing gets forwarded to storm.

How can I debug this? Does splunk have any local log files that I can check to see what's really doing?

Tags (1)
0 Karma

systeminsights
New Member

I think I have an answer. For all of the above I had not yet opened the firewall to storm. Once I did that using the original wildcard every tenant showed a log file being monitored (albeit under the directories section).

As to my other question, how to monitor what the forwarder was doing:

$SPLUNK/var/log/splunk/splunkd.log

0 Karma

systeminsights
New Member

Hmm, so I executed the following

$ splunk add monitor /opt/vimana/tenant/x7777/log/vimana.log

And now the list monitor looks like:

Monitored Directories:
    /opt/vimana/tenant/x7777/log/vimana.log
Monitored Files:
    /opt/vimana/tenant/*/log/vimana.log

And I thought was confused before...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...