Getting Data In

Windows Directory Monitoring: How to get file monitoring activity returned to my splunk server?

rsbst19
Engager

Hi all, 

Splunk newbie with what I hope is a simple question...
I have a UF installed on my windows file server, and it is set to monitor a directory--see below


[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest
monit
[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled = 0
start_from = oldest

[monitor://D:\documents\Confidential]
disabled = false

 The intent is for it to report access/modifications/deletions to files in that directory, but I am not getting any file monitoring activity returned to my splunk server when I perform a simple query for the windows host.  I do get all the system and security events, though.

Any ideas on why I'm not getting the file monitoring activity?  Thanks!

Labels (3)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rsbst19,

to monitor file activities, you have to enable this logging on the server (beware because it's really verbose and heavy for the server resources!), then you can monitor it in Splunk using the same wineventlog stanza, you don't need an additional stanza.

For this you need a Windows technician not a Splunker!

The stanza you added is to monitor the contents of log files of this folder, not activities on files!

Ciao.

Giuseppe

 

View solution in original post

rsbst19
Engager

Great.  Thanks for the explanation Giuseppe!  

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsbst19,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rsbst19,

to monitor file activities, you have to enable this logging on the server (beware because it's really verbose and heavy for the server resources!), then you can monitor it in Splunk using the same wineventlog stanza, you don't need an additional stanza.

For this you need a Windows technician not a Splunker!

The stanza you added is to monitor the contents of log files of this folder, not activities on files!

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...