Getting Data In

Windows File System Monitoring with FSChange

kholleran
Communicator

Hello,

We have some filesystem monitoring set up across our enterprise but it does not seem to be working.

The machines are all windows machines, monitoring files in paths without spaces seems to be working fine (i.e. c:\windows\system32) but any path with a space (i.e. c:\Program Files) is not working. Do I have to escape the space in the path to do this? I have tried a forward slash to no avail. How do I do this?

Example:

[fschange:C:\Program/ Files\SoftwarePackage]
index=main
recurse=true
followLinks=false
signedaudit = false 
pollPeriod=3600
hashMaxSize=N
fullEvent=false
sendEventMaxSize = 1048576 
delayInMills = 1000 
filters = binaries,xml-files,terminal-blacklist

Thanks for your help.

Kevin

cervelli
Splunk Employee
Splunk Employee

You may be hitting a known issue. This answer discuss it, and potential work-arounds:

http://answers.splunk.com/questions/2882/using-fschange-to-monitor-windows-filesystem

kholleran
Communicator

Oh, this is on a forwarder running 4.1.4 and the main server is running 4.1.6.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...