configuration monitoring across multiple boxes

[kkalmbach]

I am looking to monitor configuration files (not splunk's config files, but a app's config files).

I can use fschange to monitor when a configuration file has changed (using fullevent, so I have the contents of the file).

I also want to compare a file on box1 vs the same file on box2. I want a list of all files that are different between the two boxes and if they are different, I want to see the diffs (using the diff command?).

What is the easiest way to do this.

Thanks -Kevin

[yannK]

Splunk monitoring will look at the new lines added to a file. And consider new lines as new events.
This is different that doing version control.

If you want to compare the whole file between servers, you will have to index it fully on a regular basis.
A scripted input could be used for that. And use a special sourcetype to avoid the file to be cut in multiple events (multiline default is 255 lines), and use the current timestamp, not any timestamp in the file.

And to compare them between server, you will have to compare field per field.

[sntips]

I think you want something like Tripwire or GuardRail (by ScriptRock).