We have a server performing IN and OUT operation on a file, when a file gets generated in the folder, it doesn't stay for a long time (not even few seconds) which is a normal behaviour. Now, we want Splunk to monitor if a file stays there for longer time, say like 10min and alert us.
I tried reading Splunk Answers, but I couldn't get to any solutions.
Can someone throw some light on how to achieve this?
Thank you,
Please check the fschange
File system change monitor (fschange monitor)
https://answers.splunk.com/answers/63715/file-age-processing-measurement.html
https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Inputsconf
on linux, this audit package will be very helpful:
https://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html
Hi inventsekar,
I did read about this but not sure if it suits my requirement here or not. fschange will monitor for any modifications but my file doen't have any modifications once it gets created. Not sure why I can use this in my case.
[fschange:/xxx/yyy/pending]
pollPeriod=60
sourcetype=PendingFileMonitor
This will create an event every time a file is added, deleted or changed in the directory.