Getting Data In

FS Change keeps adding and deleting files from monitoring

jdunlea_splunk
Splunk Employee
Splunk Employee

I am monitoring /etc/hosts.allow and /etc/hosts.deny for change, with a poll period of 300 seconds.

[fschange:/etc/hosts.allow]
index = fschange_main
pollPeriod = 300

[fschange:/etc/hosts.deny]
index = fschange_main
pollPeriod = 300

For some reason, every poll period (5 mins) I get 2 events for each file.... one with "action=add" and another with "action=delete"..... as I said, this keeps happening once per poll period.

Can someone tell me what is wrong? I do not have duplicate fschange stanzas for those files.

Thanks!

John

daniel333
Builder

Was there ever a fix to this? Seems like a weird problem to have other files are working great

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

This is a known issue. It's unknown if / when it will be fixed since fschange is a deprecated feather.

0 Karma

flo_cognosec
Communicator

Yep, here too 😞

0 Karma

gavin1_davenpor
Path Finder

bump. Happening here too.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...