Getting Data In

fschange, file system change detection not working, how do I verify?

clyde772
Communicator

I have changed input.conf and restarted Spulnk, but I can't see any event generated for changing /etc/hosts file.

The the procedure was

  1. Added inputs.conf for fschange conf.
  2. Restarted Splunk.
  3. Changed /etc/hosts file to see splunk generated event
  4. logined to Splunk for fschange log.

And the I coould find the fs change log. Am I missing any procedure?

=====================================

[root@splunk local]# pwd
/opt/splunk/etc/system/local
[root@splunk local]# cat inputs.conf
[default]
host = splunk

[fschange:/etc]
index=os
recurse=true
followLinks=true
pollPeriod=60
fullEvent=true

=====================Splunk Restarted

Tags (1)

bwooden
Splunk Employee
Splunk Employee

Are you searching for something like this?

index=os source="fschangemonitor" path=*hosts*

bwooden
Splunk Employee
Splunk Employee

If that search doesn't return results, what Splunk & OS version are you using?

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...