How to monitor a folder in Windows ? C:\Windows\assembly

[chimbudp]

I would like to monitor assembly folder in windows.
Path :- C: \Windows \assembly

I have set the inputs.conf in Universal forwarder as below:

[monitor://path]
disabled = 0
interval= 00
index = Assemby_monitor
fullEvent = true

I have received no data under the Assembly_monitor index .
Do i need to set any other properties ?
Please help

[Drainy]

Ayn is trying to help below, you're best replying with actual detail and problems to his responses rather than starting a new question each time you have a reply 🙂

[Ayn]

What do you mean by that you want to monitor the assembly directory? This directory mainly consists of binary files, so I'm assuming you don't want to actually index their contents...?

[MHibbin]

Hi,

You should check the docs for this file, here.

Firstly, I would just set the directory in the stanza, like this:

[monitor://C:\Windows\assembly]

Secondly, you do not require the "interval" parameter, this is for the Script and Perfmon stanzas.

Thirdly, you do not require the "fullEvent" parameter, this is for the FSChange stanza which is deprecated (as v5).

The following is probably what you want:

[monitor://C:\Windows\assembly]
index=Assembly_monitor

To confirm, are you searching with index="Assembly_monitor"? This will be required, unless you allow users to search across this index by default.

Hope this helps

[Ayn]

No, because you're using a monitor input, not fschange. By default Splunk will not read binary files because, well, they're binary and not very useful to work with in Splunk. You should use fschange.

[chimbudp]

Hello Ayn,

inputs.conf as in Universal forwarder:

[monitor://C:\Windows\assembly]
disabled = 0
index = Assembly_Monitor
sourcetype = assembly_logs

props.conf in UF & indexer :

[assembly_logs]
KV_MODE = xml

But , i am not getting any data into Splunk now .

[Ayn]

You're going about this the wrong way. See answers to previous questions (asked by you...):

http://splunk-base.splunk.com/answers/75630/how-to-monitor-assembly-folder-in-windows
http://splunk-base.splunk.com/answers/75697/to-monitor-a-file-directory-via-forwarder

[chimbudp]

I can able to get the data into Splunk after i set the props.conf :
[Assembly]
NO_BINARY_CHECK = true

Now ,i am getting all the binary data - how can i get the relevant fields ?
Like Assembly name, date created , Version ., etc.

[chimbudp]

[monitor://C:\Windows\assembly]
index=Assembly_monitor

the above stanza forwards no data into Splunk indexer.

i have set the source type as assembly and modified as below inputs.conf:
[monitor://C:\Windows\assembly]
index=Assembly_monitor
sourcetype=Assembly

and edited props.conf as :

[Assembly]
NO_BINARY_CHECK = true

-- Even also i am not getting any data 😞
Please help