Monitoring private shared drive on a remote server with UF.

[rajeshpakalapat]

Can someone please let me know how can I monitor the modify/delete/create actions no a shared drive in a remote server with UF installed in it?

Thank you.

[paulbannister]

Hi There,

There is a deprecated feature called FSCHANGE that is still does exactly that, although it is down as deprecated it there is no immediate plan to drop it completely to my knowledge

inputs.conf should be something along the lines of:

[fschange:*YOUR_FILE_PATH*]
fullEvent=true
pollPeriod=3600
recurse=true
sendEventMaxSize=100000
signedaudit=false
disabled=0

It may require some tweaking to the file path ensure it works with your use case and after a UF restart may also require patience if the directory itself is quite cumbersome

[rajeshpakalapat]

Thanks for the answer. I found that the file logs are not being captured by the event viewer. So first I will need to get the logs to the event viewer then send to the platform.

Any idea on getting this done?

Thanks