Universal Forwarder Dosn't forward new generated log files

[Hussein90]

Dear Friends

I have installed a universal forwarder on Free_PBX to forward call queue logs to Splunk enterprise, everything works probably. I  monitored the folder of logs which is located on  /var/log/asterisk 

I can monitor all log files while they are updating events daily but PBX generates a new log file every day these newly generated logs I can't find on Splunk enterprise. unless I restart universal forwarder then new log files appears on the data summary !

note: FREE_PBX is a Linux CentOS Based VOIP Server

Logs on Splunk

Logs on server

[scelikok]

Thank you @Hussein90,

Unfortunately, I cannot think of any reason.  It may be a permission problem or the files could be very similar, but in those cases, you cannot index them by restarting UF.

[Hussein90]

Thanks for your answer I think the issue is that UF cannot send newly generated logs, of course, we chose a folder to monitor but UF wont upload new log files only one-shot upload nd keep update the events 

[scelikok]

Hi @Hussein90,

The inputs.conf file location depends on how you created the monitor. If you created using GUI on deployment server it should have created an app for UF. You can search under /opt/splunkforwarder/etc/apps folder.

Or you can use btool on UF using below command 

/opt/splunkforwarder/bin/splunk btool inputs list --debug | grep local

 You can share output of above command

[Hussein90]

Dear Scelikok

I've found following inputs.conf when I run the command you gave me

/opt/splunkforwarder/etc/apps/search/local/inputs.conf

inputs.conf contents

[monitor:///var/log/asterisk]
disabled = false

[scelikok]

Hi @Hussein90,

Could you please share your inputs.conf file setting for these asterisk log files?

[Hussein90]

Dear scelikok

There isn't inputs.conf file in the diretory /opt/splunkforwarder/etc/system/local