FS Change keeps adding and deleting files from monitoring

[jdunlea_splunk]

I am monitoring /etc/hosts.allow and /etc/hosts.deny for change, with a poll period of 300 seconds.

[fschange:/etc/hosts.allow]
index = fschange_main
pollPeriod = 300

[fschange:/etc/hosts.deny]
index = fschange_main
pollPeriod = 300

For some reason, every poll period (5 mins) I get 2 events for each file.... one with "action=add" and another with "action=delete"..... as I said, this keeps happening once per poll period.

Can someone tell me what is wrong? I do not have duplicate fschange stanzas for those files.

Thanks!

John

[daniel333]

Was there ever a fix to this? Seems like a weird problem to have other files are working great

[bosburn_splunk]

This is a known issue. It's unknown if / when it will be fixed since fschange is a deprecated feather.

[flo_cognosec]

Yep, here too 😞

[gavin1_davenpor]

bump. Happening here too.