Monitoring Splunk

fschange monitoring /root/.ssh/authorized_keys2

JasonCzerak
Explorer

So I'm at a loss here.

.bashrc and .bash_profile are picked up just fine. however I can't get authorized_keys2 to be picked up unless I do something like /root/.ssh/* I wish to avoid known_hosts. I've tried just about everything can think of. What's weird is /root/.ssh/authorized_keys2 it self fails.

Ideas?

[fschange:/root/]
filters = root_wl,all_bl
fullEvent = true

[filter:whitelist:root_wl]

Key root files that should never change

regex1 = [^/]authorized_keys2
regex2 = [^/]
.bash_profile
regex3 = [^/]*.bashrc

[filter:blacklist:all_bl]
regex1 = .?

Tags (2)
0 Karma

MuS
Legend

Hi JasonCzerak

do you get any error in splunkd.log about this?
What happens if you add the file monitor in the UI Manager?

cheers

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...