Getting Data In

How do you get Splunk to monitor and alert if a file stays in the folder for longer time?

Navanitha
Path Finder

We have a server performing IN and OUT operation on a file, when a file gets generated in the folder, it doesn't stay for a long time (not even few seconds) which is a normal behaviour. Now, we want Splunk to monitor if a file stays there for longer time, say like 10min and alert us.

I tried reading Splunk Answers, but I couldn't get to any solutions.

Can someone throw some light on how to achieve this?

Thank you,

Tags (1)
0 Karma

inventsekar
Ultra Champion

Please check the fschange

File system change monitor (fschange monitor)

The file system change monitor has been deprecated as of Splunk Enterprise

version 5.0 and might be removed in a future version of the product.

https://answers.splunk.com/answers/63715/file-age-processing-measurement.html

https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Inputsconf

on linux, this audit package will be very helpful:
https://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

0 Karma

Navanitha
Path Finder

Hi inventsekar,

I did read about this but not sure if it suits my requirement here or not. fschange will monitor for any modifications but my file doen't have any modifications once it gets created. Not sure why I can use this in my case.

0 Karma

inventsekar
Ultra Champion
[fschange:/xxx/yyy/pending]
 pollPeriod=60
 sourcetype=PendingFileMonitor

This will create an event every time a file is added, deleted or changed in the directory.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...