Getting Data In

fschange, file system change detection not working, how do I verify?

Communicator

I have changed input.conf and restarted Spulnk, but I can't see any event generated for changing /etc/hosts file.

The the procedure was

  1. Added inputs.conf for fschange conf.
  2. Restarted Splunk.
  3. Changed /etc/hosts file to see splunk generated event
  4. logined to Splunk for fschange log.

And the I coould find the fs change log. Am I missing any procedure?

=====================================

[root@splunk local]# pwd
/opt/splunk/etc/system/local
[root@splunk local]# cat inputs.conf
[default]
host = splunk

[fschange:/etc]
index=os
recurse=true
followLinks=true
pollPeriod=60
fullEvent=true

=====================Splunk Restarted

Tags (1)

Splunk Employee
Splunk Employee

Are you searching for something like this?

index=os source="fschangemonitor" path=*hosts*

Splunk Employee
Splunk Employee

If that search doesn't return results, what Splunk & OS version are you using?

0 Karma