Is monitoring .conf files on forwarders any different from monitoring any other file?

[swagner1965]

We want to watch the /local .conf files on our forwarders and alert if changes are made. Is this as simple as setting up the monitoring just like we would for any other files? This is for answering an RMF control.

[nickhills · Accepted solution]

Yes, although you should be aware that a deployment server could be pushing config changes to your forwarders.
If the change is to a lookup/dashboard etc, the app will be redeployed to the forwarder, and the conf files will be replaced even though the content may be unchanged. Just something to watch out for

[swagner1965]

Thanks and thanks.