Below is the path I am trying to monitor
C:\Program Files (x86)\Okta\Okta RADIUS Agent\current\logs\okta_radius and I used the following monitoring stanza
[monitor://C:\Program Files (x86)\Okta\Okta RADIUS Agent\current\logs\okta_radius]
index = okta
sourcetype = okta_radius
Is this the correct stanza or syntax?
That is a perfectly reasonable and fully functional setting.
View solution in original post
Thank you.So it should be an issue with permission .Can we check specifically internal logs to see the error
index=_* okta_radius (ERROR OR WARN* OR FAIL* OR CANNOT OR TIMEOUT OR CRASH* OR UNABLE)