Directory monitoring / change monitoring questions

[flo_cognosec]

Hi Guys

I am new to splunk and have been tasked with something that seems a bit challenging to achieve:

What I got

/directoryA/some_very_important_files
All changes need to be monitored

/directoryA/some_not_so_importand_files
new files / deleted files should be noted

Out of architectural issues this is not changeable and I would like to know how to best monitor this.

Do I have to use absolute paths like /directoryA/some_file.sh for all the files ?

Do I understand correctly that I cannot do this:
(
I want to get a "baseline" of all existing files and then subsequently get all the changes to the config files in the directory
)

monitor /directoryA

fschange /directoryA/file.sh

If I just want the config files to be fully imported and indexed (with content) and the binary files just to be indexed as existing (indexing some 3 meg binary file is actually quite useless I think) it seems to be possible but only with a lot of manual configuration ?

Last time I tried this with windows, I got a font file indexed roughly 800.000 times for no apparent reason 😕

[flo_cognosec]

Note: Monitor inputs should not overlap. That is, monitoring /a/path while also monitoring /a/path/subdir will produce unreliable results. Similarly, monitor inputs that watch the same directory with different whitelists, blacklists, and wildcard components are not supported.

Sounds like a splunk limitaton here 😕

[kristian_kolb]

No, you cannot [monitor] and [fschange] the same files/directories, but you can 'index' the files with fschange, if you add fullEvent=true to your [fschange] stanza. However, I'm not sure that fschange will 'index' the files the first time it sees them, or if it's only when the file changes.

As for explicitly configuring the exact path to each file, I don't think it's necessary. If your config files all end with .conf, and no binary files do that, you can write blacklists/whitelists to ensure that the correct files get fschange-indexed (fullEvent=true). NB. I haven't tried this, and I'm not 100% sure if there will be some sort of conflict for the two fschange-stanzas pointing at the same directory.

In inputs.conf

[fschange:/directoryA/]
filters=skip_conf

[fschange:/directoryA/]
filters=incl_conf
fullEvent=true

[filter:blacklist:skip_conf]
regex1=.*\.conf$

[filter:whitelist:incl_conf]
regex1=.*\.conf$

Give it a shot, if you dare 🙂

/kristian