Are there any reasons to setup both monitor and fschange on the same path?

Are there any reason to setup both [monitor://] and a [fschange:] inputs for a single path? Are there any problems with doing this, and if not, what would be the advantages to such a configuration?

I ask this because I notice that Splunk's unix app does this in both Splunk 4.0.10 and Splunk 4.1.1.

Snipet from inputs.conf:

[fschange:/etc]
index=os
pollPeriod = 300
fullEvent = true
filesPerDelay=5
delayInMills=100

[monitor:///etc]
_whitelist=(\.conf|\.cfg|config$|\.ini|\.init|\.cf|\.cnf|shrc$|^ifcfg|\.profile|\.rc|\.rules|\.tab|tab$|\.login|policy$)
index=os

In 4.0, both of the inputs are enabled by default (once you enable the unix app, of course). In 4.1 the unix app has all inputs disabled by default (which is a more sane default, IMHO). Either way, both stanzas are there.

asked 29 Apr '10, 00:12

Lowell ♦
9.6k●6●35
accept rate: 40%

edited 05 May '10, 14:05

One Answer:

oldest newest most voted

According to the docs for inputs.conf, this is not supported.

NOTE: You cannot simultaneously watch a directory using fs change monitor and monitor (above).

But, that said, the unix app does configure both inputs in spite of the docs saying it can't be done.

link

answered 29 Apr '10, 02:01

dwaddle ♦
11.2k●1●5●16
accept rate: 34%

I think our preclusion of this behavior is basically stale. Given that we do it all over the place, and I think customers are doing it, it does work.

(05 May '10, 14:50) jrodman ♦

So, any idea on why this is done, what advantage it provides?

(05 May '10, 17:51) Lowell ♦

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

unix ×77
fschange ×53
directory-monitor ×28

Asked: 29 Apr '10, 00:12

Seen: 815 times

Last updated: 05 May '10, 14:05

Are there any reasons to setup both monitor and fschange on the same path?

Follow this question

Splunk Resources

Related questions