Getting Data In

File Integrity Monitoring - Splunk 6

dgavic
Explorer

With FSChnage being deprecated in Splunk 5.0, what is the best method in Splunk 6 to monitor folder/file changes?

Thank you

Tags (3)
0 Karma

IT_Bullgod
Splunk Employee
Splunk Employee

The term Deprecation is misleading many of our customers. The fact remains - Splunk continues to maintain a file integrity checking feature through ver 5 and into the current version. See the link below:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem

Hooshiar
Observer

Hello

The link is for version 6.0 and no longer exists.

"http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem"

You can use this link instead:
https://docs.splunk.com/Documentation/Splunk/9.2.2/Data/Monitorchangestoyourfilesystem
Although the contents of this document did not match the solution I wanted
In the SIM solution of ManageEngine company, it is possible to monitor a folder that has been Shared in such a way that if a file or folder is created, edited, renamed or deleted, it shows by which user and at what time and from which IP It happened.
I am looking for such a solution in Splunk

0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. It's a veeeeeery old thread (over 10 years since last post)

2. Monitoring changes to filesystem is a completely different issue than logging changes on a file sharing platform (regardless of whether we're talking NFS, CIFS, DAV...). First thing would be to make sure that the service itself can and will log relevant data.

0 Karma

IT_Bullgod
Splunk Employee
Splunk Employee

The term Deprecation is misleading many of our customers. The fact remains - Splunk continues to maintain a file integrity checking feature through ver 5 and into the current version. See the link below:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Monitorchangestoyourfilesystem

0 Karma

dgavic
Explorer

I did find this write up in the docs section, and this helped get me going in the right direction.

http://docs.splunk.com/Documentation/Splunk/6.0/Data/MonitorfilesystemchangesonWindows

I am always open for more suggestions, or an easier way to do this.

Thank you

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...