File and Directory Monitoring with Splunk

lohit · ‎11-14-2013

Hi all,

Since fschange is a deprecated feature post Splunk 5.0, i wwould like to know how to monitor windows and linu files/directories. For windows something comes to mind to enable auditing feature either as a GPO/local policy but nothing on linux. Please let me know what is the best possible approach to do this ?

martin_mueller · ‎11-15-2013

For Linux you could use auditd to configure what to audit where, and Splunk the log from /var/log/audit/audit.log.

File and Directory Monitoring with Splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

File and Directory Monitoring with Splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue