Unathorized Linux folder deletion

[ajeeshneelamkav]

Hi All,

I am new to Splunk and need to complete the below use case

Files in a linux directory are regularly archived to different directory. File deletion in this directory needs to be monitored.

Example directory: user/data/files on a Linux machine
Splunk ver:6.1

[kml_uvce]

use this in inputs.conf
[fschange:<path>]

http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

[ajeeshneelamkav]

if a folder deletes from Linux or files deleted from a Linux folder, will be there any specific keyword?

[kml_uvce]

see in your events or send any event...

[ajeeshneelamkav]

I have done it, how can retrieve this particular change using search query to create an alert ?

[kml_uvce]

how you done it , by using fschange /?
see keywords related to you deletion event and write search :

index=<indexname> "keywords" and then go to save as-> alert

[Ayn]

fschange is deprecated. Recommended option is to use each OS's native mechanisms for auditing filesystem activity, like auditd in Linux.

[kml_uvce]

Hi Ayn

I am not seeing fschange is deprecated in latest version 6.2 http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/inputsconf

please correct me If I am wrong...

[Ayn]

http://docs.splunk.com/Documentation/Splunk/6.2.0/releasenotes/Deprecatedfeatures

[kml_uvce]

hmmm, usually splunk gives any deprecated features in conf files also, but they have not given in inputs.conf for fschange, they need to change the doc for inputs.conf...

[Ayn]

No, "deprecated" does not mean "removed". The functionality is still there, but is due for removal, and the recommendation is to explore other options instead.

[kml_uvce]

yeah i am saying that splunk always mentioned that features is deprecated in conf files doc also but here splunk has not mentioned