- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to exclude files and folders from monitori...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to exclude files and folders from monitoring
This is with respect to my earlier post /root monitoring.
Now I am able to captured activities done under /root, But I have one small query That, how can I exclude certain files and folders from monitoring.
Is there any way out ?
Because under /root there are number of files and folders, which I dont want to monitored all of them.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi catch_mili
you black- and whitelist any input, read more at http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Whitelistorblacklistspecificincomingdata
cheers,
MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Ayn,
Appericiate, if you give me an example.
Even, I tried this one
[filter:blacklist:file.txt]
regex1 = .*txt
[fschange:/etc]
filters = file.txt
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[monitor:///etc]
blacklist = (xyzfile)
didnt worked, If i do any changes it is detected by Splunk, However, I have blacklisted that file.
Pls. help...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your syntax for fschange blacklisting is still wrong.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[fschange:/]
followLinks=true
pollPeriod=120
index = os
disabled = 0
blacklist = .(txt)$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[monitor:///etc]
_whitelist=(.conf|.cfg|config$|.ini|.init|.cf|.cnf|shrc$|^ifcfg|.profile|.rc|.rules|.tab|tab$|.login|policy$)
_blacklist = .(txt)$
index=os
disabled = 0
I have blacklist .txt files from monitoring, but if I do any modification in File it still shows under file modify Tab.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What will be the syntax if I dont want to monitor /root/folder
below is just an example, assume, I dont want to monitor particular folder under /root
[monitor:///root]
blacklist = .(foldername)$
Will this work ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[fschange:/root]
followLinks=true
pollPeriod=120
index = os
disabled = 0
blacklist = . (tempfile) $
Actually, monitoring /root, under I have one tempfile which I dont want to monitored. But when I do changes its captured by Splunk, not sure where went wrong pasted entry above.
Pls. help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
catch_mili, generally reading the docs is a good idea.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
