Splunk Search

Unathorized Linux folder deletion

ajeeshneelamkav
New Member

Hi All,

I am new to Splunk and need to complete the below use case

Files in a linux directory are regularly archived to different directory. File deletion in this directory needs to be monitored.

Example directory: user/data/files on a Linux machine
Splunk ver:6.1

Tags (2)
0 Karma

kml_uvce
Builder

use this in inputs.conf
[fschange:<path>]

http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

kamal singh bisht
0 Karma

ajeeshneelamkav
New Member

if a folder deletes from Linux or files deleted from a Linux folder, will be there any specific keyword?

0 Karma

kml_uvce
Builder

see in your events or send any event...

kamal singh bisht
0 Karma

ajeeshneelamkav
New Member

I have done it, how can retrieve this particular change using search query to create an alert ?

0 Karma

kml_uvce
Builder

how you done it , by using fschange /?
see keywords related to you deletion event and write search :

index=<indexname> "keywords" and then go to save as-> alert

kamal singh bisht
0 Karma

Ayn
Legend

fschange is deprecated. Recommended option is to use each OS's native mechanisms for auditing filesystem activity, like auditd in Linux.

0 Karma

kml_uvce
Builder

Hi Ayn

I am not seeing fschange is deprecated in latest version 6.2 http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

please correct me If I am wrong...

kamal singh bisht
0 Karma

Ayn
Legend
0 Karma

kml_uvce
Builder

hmmm, usually splunk gives any deprecated features in conf files also, but they have not given in inputs.conf for fschange, they need to change the doc for inputs.conf...

kamal singh bisht
0 Karma

Ayn
Legend

No, "deprecated" does not mean "removed". The functionality is still there, but is due for removal, and the recommendation is to explore other options instead.

0 Karma

kml_uvce
Builder

yeah i am saying that splunk always mentioned that features is deprecated in conf files doc also but here splunk has not mentioned

kamal singh bisht
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...