Windows Directory Monitoring: How to get file monitoring activity returned to my splunk server?

[rsbst19]

Hi all, 

Splunk newbie with what I hope is a simple question...
I have a UF installed on my windows file server, and it is set to monitor a directory--see below

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
monit
[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[monitor://D:\documents\Confidential]
disabled = false

 The intent is for it to report access/modifications/deletions to files in that directory, but I am not getting any file monitoring activity returned to my splunk server when I perform a simple query for the windows host.  I do get all the system and security events, though.

Any ideas on why I'm not getting the file monitoring activity?  Thanks!

[rsbst19]

Great.  Thanks for the explanation Giuseppe!  

[gcusello]

Hi @rsbst19,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello · Accepted solution]

Hi @rsbst19,

to monitor file activities, you have to enable this logging on the server (beware because it's really verbose and heavy for the server resources!), then you can monitor it in Splunk using the same wineventlog stanza, you don't need an additional stanza.

For this you need a Windows technician not a Splunker!

The stanza you added is to monitor the contents of log files of this folder, not activities on files!

Ciao.

Giuseppe