Getting Data In

Monitoring the content of a configuration file

u568675
New Member

I have a client that wants to monitor a system configuration file and specifically the content of the configuration file. They would like to index the content of a file and ultimately the only index the content again when the configuration file content changes.
We've tied using "fschange" but it's only outputting the file characteristics (see below) not the file content

Tue Jun 4 10:07:32 2019 action=add, path="///opt/mapr/spark/spark-2.2.1/conf/spark-defaults.conf", isdir=0, size=1957, gid=1446, uid=930, modtime="Wed Jan 23 15:58:32 2019", mode="rw-r--r--", hash=***

the inputs.conf configuration setting for "fschange" that we've tried are:
[fschange:///opt/mapr/spark/spark-2.2.1/conf/spark-defaults.conf]

index = _audit
recurse = false
followLinks = false
signedaudit = false
fullEvent = true
sendEventMaxSize = 1048576
delayInMills = 1000***

Has someone successfully index a configuration file content and re-indexed the configuration content when the configuration content changes?

0 Karma

evania
Community Manager
Community Manager

Hi @u568675 ,

Did you have a chance to check out an answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

u568675
New Member

We added crcSalt = to the input stanza and tested by modifying the configuration file but unfortunately it do not generate an event.

0 Karma

MuS
SplunkTrust
SplunkTrust

Did you also change the stanza from [fschange:// to be [monitor:// as mentioned in my answer?

cheers, MuS

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi u568675,

Well, that is what fschange (which btw is deprecated since Splunk 5.x) does:

[fschange:<path>]
* Monitors changes (such as additions, updates, and deletions) to this
  directory and any of its sub-directories.

Source https://docs.splunk.com/Documentation/Splunk/latest/admin/Inputsconf .

If you want to index config files and index when they change, you need to add a monitor stanza and add the option crcSalt = <SOURCE> to the monitor. This will re-index the file once it changes.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...