IT Operations Discussions
All the up-time. All the nines.

monitor large file system access using monitor of inputs.conf or auditd?

shwu
Engager

We have Linux servers for providing file sharing services like Samba and NFS. We need to monitor the user access activities to the files in the shared file system.  Many posts of this community pointed to use Splunk's inputs.conf for monitoring file access. Some also pointed to using Linux's auditd to get the result. Currently our Splunk setting already collects data from audit.log. 

 What is the pro/con for using inputs.conf or auditd?

Thanks.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...