Getting Data In

fsmonitor question

diegosainz
Path Finder

Is it possible for a file monitored with fsmonitor to send an alert on any difference of the file? or would monitoring the file be able to provide that visibility.

Tags (1)
0 Karma

rnolette
Path Finder

if fsmonitor has a log file that generates events on file status changes then you can write a custom file monitor that will send the events to the splunk server. You then can create a realtime query Alert that will email you every time this event is triggered. I did this for checking when someone changes something on one of my servers that has a custom application on it.

0 Karma

diegosainz
Path Finder

Thank you. I will do that.

0 Karma

rnolette
Path Finder

oh. well you didn't say that. Does the file monitor not read in the file when it alerts you? I dont think you can do diff change monitoring from splunk. youd need a diff application to push the new copy to and the old copy then have splunk alert on what the diff application said changed. That would tell you but is a bunch of work. If the device is a network appliance, just use puppet or Cacti.

diegosainz
Path Finder

We have done that, we would like to know what has changed in the file.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...