Getting Data In

Monitor Or MonitorNoHandle ?

Hi,
If one wants to import DNS query log on windows server,
Which is appropriate to use..? Monitor or MonitorNoHandle stanza.

0 Karma

SplunkTrust
SplunkTrust

I'd use stream, actually, which can read them off the wire on the DNS. It's better and gets all the bad actors making broken requests that Windows throws away.

But to your question specifically - MonitorNoHandle seems perfect for this. Have you tried it? Does it do what you want? There's a list of reasons to use and to not use this in the docs for it. See especially the bottom - and how it won't read existing file contents and stuff.

0 Karma