IT Operations Discussions
All the up-time. All the nines.

monitor large file system access using monitor of inputs.conf or auditd?

shwu
Engager

We have Linux servers for providing file sharing services like Samba and NFS. We need to monitor the user access activities to the files in the shared file system.  Many posts of this community pointed to use Splunk's inputs.conf for monitoring file access. Some also pointed to using Linux's auditd to get the result. Currently our Splunk setting already collects data from audit.log. 

 What is the pro/con for using inputs.conf or auditd?

Thanks.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...