How can I set my monitor in inputs.conf so that both of these directories are monitored-
1./var/lib/usr
2. /var/lib/newuser/usr
If I do [monitor:///var/lib/.../usr/] - will that work for both? Or will that assume that there is at least one subdirectory between "lib" and "usr"
Thanks in advance!
In general terms these two directories separate entities. While they are in the same tree, these have different inodes and you can monitor each individually. So, the answer to your question is to create two (2) separate entries in inputs.conf.
[monitor:///var/lib/usr]
sourcetype = answers-1370379558
[monitor:///var/lib/newuser/usr]
sourcetype = answers-1370379591
Is there more to your question?