How to exclude files and folders from monitoring

[catch_mili]

This is with respect to my earlier post /root monitoring.
Now I am able to captured activities done under /root, But I have one small query That, how can I exclude certain files and folders from monitoring.

Is there any way out ?

Because under /root there are number of files and folders, which I dont want to monitored all of them.

[MuS]

Hi catch_mili

you black- and whitelist any input, read more at http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata

cheers,
MuS

[catch_mili]

Hi Ayn,

Appericiate, if you give me an example.

Even, I tried this one
[filter:blacklist:file.txt]
regex1 = .*txt
[fschange:/etc]
filters = file.txt

[catch_mili]

[monitor:///etc]
blacklist = (xyzfile)

didnt worked, If i do any changes it is detected by Splunk, However, I have blacklisted that file.

Pls. help...

[Ayn]

Your syntax for fschange blacklisting is still wrong.

[catch_mili]

[fschange:/]
followLinks=true
pollPeriod=120
index = os
disabled = 0
blacklist = .(txt)$

[catch_mili]

[monitor:///etc]
_whitelist=(.conf|.cfg|config$|.ini|.init|.cf|.cnf|shrc$|^ifcfg|.profile|.rc|.rules|.tab|tab$|.login|policy$)
_blacklist = .(txt)$
index=os
disabled = 0

I have blacklist .txt files from monitoring, but if I do any modification in File it still shows under file modify Tab.

[catch_mili]

What will be the syntax if I dont want to monitor /root/folder
below is just an example, assume, I dont want to monitor particular folder under /root

[monitor:///root]
blacklist = .(foldername)$

Will this work ?

[Ayn]

You got the syntax wrong. Read the DOCS: http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Monitorchangestoyourfilesystem#Define_a_filte...
http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Inputsconf

[catch_mili]

[fschange:/root]
followLinks=true
pollPeriod=120
index = os
disabled = 0
blacklist = . (tempfile) $

Actually, monitoring /root, under I have one tempfile which I dont want to monitored. But when I do changes its captured by Splunk, not sure where went wrong pasted entry above.

Pls. help.

[Ayn]

catch_mili, generally reading the docs is a good idea.