What could prevent the monitoring of papercut logs?

[dspencer]

• I'm collecting all other logs ie. wineventlogs, splunkd logs
• the inputs.conf is accurate
• the splunk user has full access to the file

What are some non-splunk reasons that would prevent a file from being monitored?

[marnall]

Can you search the internal index, specifically splunkd, to be sure that your configuration stanza is being parsed and that the TailingProcessor is adding a watch on the file path?

E.g.

index=_internal source="/opt/splunk/var/log/splunk/splunkd.log" <logfilename>