Getting Data In

Universal Forwarder Dosn't forward new generated log files

Hussein90
Engager

Dear Friends

I have installed a universal forwarder on Free_PBX to forward call queue logs to Splunk enterprise, everything works probably. I  monitored the folder of logs which is located on  /var/log/asterisk 

I can monitor all log files while they are updating events daily but PBX generates a new log file every day these newly generated logs I can't find on Splunk enterprise. unless I restart universal forwarder then new log files appears on the data summary !

note: FREE_PBX is a Linux CentOS Based VOIP Server

Logs on SplunkLogs on Splunk

 

Logs on serverLogs on server

 

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Thank you @Hussein90,

Unfortunately, I cannot think of any reason.  It may be a permission problem or the files could be very similar, but in those cases, you cannot index them by restarting UF.

If this reply helps you an upvote is appreciated.
0 Karma

Hussein90
Engager

Thanks for your answer I think the issue is that UF cannot send newly generated logs, of course, we chose a folder to monitor but UF wont upload new log files only one-shot upload nd keep update the events 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Hussein90,

The inputs.conf file location depends on how you created the monitor. If you created using GUI on deployment server it should have created an app for UF. You can search under /opt/splunkforwarder/etc/apps folder.

Or you can use btool on UF using below command 

/opt/splunkforwarder/bin/splunk btool inputs list --debug | grep local

 You can share output of above command

If this reply helps you an upvote is appreciated.

Hussein90
Engager

Dear Scelikok

I've found following inputs.conf when I run the command you gave me

/opt/splunkforwarder/etc/apps/search/local/inputs.conf

inputs.conf contents

[monitor:///var/log/asterisk]
disabled = false

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Hussein90,

Could you please share your inputs.conf file setting for these asterisk log files?

If this reply helps you an upvote is appreciated.
0 Karma

Hussein90
Engager

Dear scelikok

 

There isn't inputs.conf file in the diretory /opt/splunkforwarder/etc/system/local

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...