Getting Data In

Monitoring changes to configuration files

kkuminsky
Path Finder

Trying to monitor changes to configuration files.

Followed this article: http://www.splunk.com/base/Documentation/4.0.9/Admin/Monitorchangestoyourfilesystem

Created Data Input in Splunk Manager. Here is the inputs.conf (added pollPeriod manually):


[monitor://\192.168.1.12\Siteroot\Web.config]

disabled = false

host = SIT-APP-shared

host_regex =

host_segment =

index = main

sourcetype =

pollPeriod = 60


Restarted splunk after changes, share has full permissions for everyone.

Then I change web.config file. Do search in Splunk - nothing.

Does the configuration look right? How do I debug it to see if it's connecting to the share, how often, error messages etc.?

Tags (1)
1 Solution

kkuminsky
Path Finder
0 Karma

kkuminsky
Path Finder

OK, the reason it was not working is that Splunk services were running under Local System account.

Here are the articles I used to fix it:

http://www.splunk.com/base/Documentation/latest/Installation/InstallonWindows#Choosing_the_user_Splu...

http://www.splunk.com/base/Documentation/latest/Installation/CorrectingtheuserselectedduringWindowsi...

0 Karma

kkuminsky
Path Finder

It appears that it's working for local files - [fschange:C:\TEMP\test.txt], but not for network - [fschange:\10.255.1.20\Siteroot\Web.config]

So, I guess the question is how to monitor files on other machines in the network.

0 Karma

the_wolverine
Champion

What you want to do is fschange (filesystem change) monitoring which is different from monitoring. If you modify you configuration to look like that in the example on the page you linked to, it should work:

[fschange:/var/apache] 
index = sample 
recurse = true 
followLinks = false 
signedaudit = false 
fullEvent = true 
sendEventMaxSize = 1048576 
delayInMills = 1000 

kkuminsky
Path Finder

Yes, you are right. It looks like I shouldn't rely that much on GUI.

So, I've changed the config (see below). Now I don't see this record in Splunk Manager under Data Inputs anymore. Also, when I make changes to the file I'm still not able to find any records when doing search.


[fschange:\10.255.1.20\Siteroot\Web.config]

index = main

recurse = true

followLinks = false

signedaudit = false

fullEvent = true

sendEventMaxSize = 1048576

delayInMills = 1000

pollPeriod = 60

0 Karma
Get Updates on the Splunk Community!

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...