Weird Monitoring issue after AIX Universal Forwarder Upgrade

[aknsun]

Hi,

We have an issue with an AIX server that just doesn't seem to monitor a particular log file after it was upgraded from v4.3.2 to v6.4.2. All the other logs mentioned in the inputs.conf are working fine. It' just this particular stanza that seems to be having and issue and that too, just on this particular server. Other servers upgraded along with it don't have this issue. And there are no blank spaces or any of that sort. This was cross checked.

Stanza is in the following format.

[monitor:///blah-blah*]
index = abc
host = server1
sourcetype = def

Anyone faced similar issue after AIX UF upgrade?

Thanks,
AKN

[oscar84x]

Does the user Splunk is running under have read permissions to the file?
Perhaps it was running under a different user before the upgrade.

If that's not the case are you seeing any specific errors?
You can also run the search below, look at the "file" field, and search for events related to the specific file:

index=_internal component=WatchedFile