- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- is it possible to use file monitoring on external ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
Would like to ask if it is possible to monitor files outside the server without using a forwarder. Thank you in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I presume you mean without using a forwarder "on that" system?
Two approaches immediately spring to mind:
1.) Map/Mount the remote filesystem onto a suitable host which is running the forwarder
2.) Script or otherwise schedule log shipping from your target server to your forwarder and process them as if they were local logs.
In both cases you can override the hostname so that the logs get attributed to the correct server
There are pros and cons to each, but will depend on your use case.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi nickhillscpl,
how about if the servers are in two different networks?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I presume you mean without using a forwarder "on that" system?
Two approaches immediately spring to mind:
1.) Map/Mount the remote filesystem onto a suitable host which is running the forwarder
2.) Script or otherwise schedule log shipping from your target server to your forwarder and process them as if they were local logs.
In both cases you can override the hostname so that the logs get attributed to the correct server
There are pros and cons to each, but will depend on your use case.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thank you for that answer nickhillscpl. how about if the servers are in different network? what we're trying to achieve is that we monitor the logs on a specific server on a different network without installing a forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
what access do you have to these servers? are they windows or linux?
Detecting Remote Code Executions With the Splunk Threat Research Team
Enter the Splunk Community Dashboard Challenge for Your Chance to Win!
.conf24 | Session Scheduler is Live!!
