Monitoring Splunk

configuration monitoring across multiple boxes

kkalmbach
Path Finder

I am looking to monitor configuration files (not splunk's config files, but a app's config files).

I can use fschange to monitor when a configuration file has changed (using fullevent, so I have the contents of the file).

I also want to compare a file on box1 vs the same file on box2. I want a list of all files that are different between the two boxes and if they are different, I want to see the diffs (using the diff command?).

What is the easiest way to do this.

Thanks -Kevin

0 Karma

yannK
Splunk Employee
Splunk Employee

Splunk monitoring will look at the new lines added to a file. And consider new lines as new events.
This is different that doing version control.

If you want to compare the whole file between servers, you will have to index it fully on a regular basis.
A scripted input could be used for that. And use a special sourcetype to avoid the file to be cut in multiple events (multiline default is 255 lines), and use the current timestamp, not any timestamp in the file.

And to compare them between server, you will have to compare field per field.

sntips
New Member

I think you want something like Tripwire or GuardRail (by ScriptRock).

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...