Getting Data In

Windows Directory Monitoring: How to get file monitoring activity returned to my splunk server?

rsbst19
Engager

Hi all, 

Splunk newbie with what I hope is a simple question...
I have a UF installed on my windows file server, and it is set to monitor a directory--see below


[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
monit
[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[monitor://D:\documents\Confidential]
disabled = false

 The intent is for it to report access/modifications/deletions to files in that directory, but I am not getting any file monitoring activity returned to my splunk server when I perform a simple query for the windows host.  I do get all the system and security events, though.

Any ideas on why I'm not getting the file monitoring activity?  Thanks!

Labels (3)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rsbst19,

to monitor file activities, you have to enable this logging on the server (beware because it's really verbose and heavy for the server resources!), then you can monitor it in Splunk using the same wineventlog stanza, you don't need an additional stanza.

For this you need a Windows technician not a Splunker!

The stanza you added is to monitor the contents of log files of this folder, not activities on files!

Ciao.

Giuseppe

 

View solution in original post

rsbst19
Engager

Great.  Thanks for the explanation Giuseppe!  

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsbst19,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsbst19,

to monitor file activities, you have to enable this logging on the server (beware because it's really verbose and heavy for the server resources!), then you can monitor it in Splunk using the same wineventlog stanza, you don't need an additional stanza.

For this you need a Windows technician not a Splunker!

The stanza you added is to monitor the contents of log files of this folder, not activities on files!

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...