fschange and legacy system logs app

[tkwaller]

Have an app that monitors system logs. Specifically files in the /etc/ path using fschange.
I know that fschange is "deprecated" but is currently working. I would like to update this app to current standards as it is a legacy app.
the stanza for this is:

[fschange:/etc/]
fullEvent=true
pollPeriod=180
recurse=true
sendEventMaxSize=100000
filesPerDelay=5
delayInMills=100
index=_audit

what would be the best practice for this or should it be left?

the main issue I have with this is that its picking up a log in that path and throwing :

08-11-2016 16:38:06.066 +0000 WARN  LineBreakingProcessor - Truncating line because limit of 10000 bytes has been exceeded with a line length >= 10734 - data_source="/etc/mcollective/facts.yaml", "myhost.com", data_sourcetype="yaml-10"

How should I adjust the input to fix the breaking issue?

Thanks for the thoughts.

[jkat54]

fschange tells you when permissions on a file, etc are changed. It's hard to replace it.

What you could do is write a script that checks the permissions and drops those into the _audit index, but then you'll never really know EXACTLY when the permissions change happened. If a file is edited, etc. you can see it was by checking the modified date, but even the modified date can be "hacked".

So I'd stick with fschange for now if you really need the permissions auditing. However, there are better tools for monitoring file system permissions and access to files, that's why splunk deprecated this feature.

As for adjusting your inputs, you need to add TRUNCATE = <positive_integer> to your props.conf

http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Propsconf

TRUNCATE = <non-negative integer>
* Change the default maximum line length (in bytes).
* Although this is in bytes, line length is rounded down when this would
  otherwise land mid-character for multi-byte characters.
* Set to 0 if you never want truncation (very long lines are, however, often
  a sign of garbage data).
* Defaults to 10000 bytes.

[wilsonite]

Looks like you will want to adjust the props.conf file rather than your input.

Try this thread here:
https://answers.splunk.com/answers/4162/size-limit-for-an-event.html