Getting Data In

Confused about universal forwarding file monitoring

New Member

I have setup a monitor for '/opt/vimana/tenant/*/log/vimana.log'. When I do 'splunk list monitor' I get this:

Monitored Directories:

I don't understand this at all. Every one of these log directories contains a file called 'vimana.log', but only one is listed above and for that tenant it does not list the directories. All of the files are being appended to by apps, but nothing gets forwarded to storm.

How can I debug this? Does splunk have any local log files that I can check to see what's really doing?

Tags (1)
0 Karma

New Member

I think I have an answer. For all of the above I had not yet opened the firewall to storm. Once I did that using the original wildcard every tenant showed a log file being monitored (albeit under the directories section).

As to my other question, how to monitor what the forwarder was doing:


0 Karma

New Member

Hmm, so I executed the following

$ splunk add monitor /opt/vimana/tenant/x7777/log/vimana.log

And now the list monitor looks like:

Monitored Directories:
Monitored Files:

And I thought was confused before...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...