Getting Data In

monitoring all auth.log file

darksky21
Path Finder

Hi i would like to monitor all auth.log file in my ubuntu system but there are many auth.log file (e.g. auth.log, auth.log.1, auth.log.2.gz, auth.log.3.gz). How do i get splunk to monitor all of them? Currently am only able to monitor auth.log file only

Tags (3)
0 Karma

aktambe
New Member

Hi,

I to have the same issue. we are monitoring the RSA key file from some host and we are getting logs from all the source excluding one source. the folder where auth.log file are fetched is present on that host but splunk cant fetch the logs. the configuration of all the host are same and the permission to the auth.log dir is also same for all the servers. still not getting log.

Please help here!

0 Karma

yannK
Splunk Employee
Splunk Employee

monitor the file and it's rotated versions.

[monitor:///var/log/auth.log*]

gfuente
Motivator

Hello

Maybe it's a permissions issue or they all have the same header and Splunk, by defaults, think that already has indexed that file. You could try to add this to your inputs.conf file:

crcSALT = < SOURCE >

**Remove the blanks before and after SOURCE, and you dont need to put here your real source file, just the string SOURCE

Regards

0 Karma

darksky21
Path Finder

Hi there. i tried it but it only monitor auth.log and not the other auth.log file.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...