Deployment Architecture

How to monitor logs on Linux directory?

pamelaferrari
New Member

I installed Splunk on a Windows machine. I have some applications that runs on a Linux server and generates daily logs on a specific Linux directory. I would like to monitor these logs from Splunk. I know there is the Splunk Universal Forwarder but first I would try to create a script on Splunk that runs an ssh (with cat logs file) and keeps the logs from the Linux directories.
Can you please explain me how can achieve this result? Can you give me an example?
Thank you very much
Regards

0 Karma

skalliger
Motivator

This would require writing your own file watcher (or using someone else's), transfering the files (think about transfering it securely) and also think about the future. You want to keep the footprint of the process on the target system low and maybe want to loadbalance events later to multiple directions.

But if you really don't want to just install the Universal Forwarder (which is recommended), you can always try to do it with a Scripted Input.

I really don't see a reason why you would want to implement such functionality yourself. The UF might not be good at filtering events, but he is good enough in gathering them.

Skalli

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...