Monitoring Splunk

Weird Monitoring issue after AIX Universal Forwarder Upgrade

aknsun
Path Finder

Hi,

We have an issue with an AIX server that just doesn't seem to monitor a particular log file after it was upgraded from v4.3.2 to v6.4.2. All the other logs mentioned in the inputs.conf are working fine. It' just this particular stanza that seems to be having and issue and that too, just on this particular server. Other servers upgraded along with it don't have this issue. And there are no blank spaces or any of that sort. This was cross checked.

Stanza is in the following format.

[monitor:///blah-blah*]
index = abc
host = server1
sourcetype = def

Anyone faced similar issue after AIX UF upgrade?

Thanks,
AKN

Tags (1)
0 Karma

oscar84x
Contributor

Does the user Splunk is running under have read permissions to the file?
Perhaps it was running under a different user before the upgrade.

If that's not the case are you seeing any specific errors?
You can also run the search below, look at the "file" field, and search for events related to the specific file:

index=_internal component=WatchedFile
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...