This file has been manually created on a universal forwarder A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new Which file…

The correct answer is B. /var/log/maillog. When a deployment server pushes an app to a universal forwarder, it overwrites any manually created files in that app's directory with the version managed by the deployment server. The original inputs.conf monitoring /var/log/messages is replaced by the newly deployed…

Splunk Deployment and Licensing

Question

This file has been manually created on a universal forwarder A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new Which file is now monitored?

Exhibits

Options

A/var/log/messages
B/var/log/maillog
C/var/log/maillog and /var/log/messages
Dnone of the above

How the community answered

(29 responses)

A
7% (2)
B
76% (22)
C
3% (1)
D
14% (4)

Explanation

When a deployment server pushes an app to a universal forwarder, it overwrites any manually created files in that app's directory with the version managed by the deployment server. The original inputs.conf monitoring /var/log/messages is replaced by the newly deployed inputs.conf that monitors /var/log/maillog. This is a key reason why manually editing files inside managed apps on forwarders is discouraged - any deployment will overwrite those changes. Only /var/log/maillog is monitored after the deployment.

Topics

#Universal Forwarder#Deployment Server#Configuration Precedence#App Deployment

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice