ConfigWatcher

The ConfigWatcher collector monitors content changes in files or directories, constructs change event data, and reports it to the platform.

Configuration¶

Host InstallationKubernetes

Navigate to the conf.d/host directory in your DataKit installation path, copy configwatcher.conf.sample and rename it to configwatcher.conf. Example:

[[inputs.configwatcher]]
  ## Require. A name for this collection task for identification.
  source = "default"

  ## The root path to prepend to all monitored paths (e.g., for container host paths).
  ## Use "/rootfs" for the mount point in Kubernetes.
  mount_point = ""

  ## An array of files or directories to monitor for changes.
  ## Note: Wildcards (e.g., '/path/*.log') are not supported.
  paths = [
      # "/var/spool/cron/crontabs/",          # for entire directory
      # "/etc/hosts",                         # for specific file
  ]

  ## The interval at which to check for changes.
  interval = "5m"

  ## Whether to recursively monitor directories in the provided paths.
  recursive = true

  ## The maximum file size (in bytes) for which to compute content diffs, default is 256KiB.
  max_diff_size = 262144

  [inputs.configwatcher.tags]
  # some_tag = "some_value"
  # more_tag = "some_other_value"

After configuration, restart DataKit.

Currently enabled by injecting collector configuration via ConfigMap.

Example Configuration: Crontab¶

Below is an example configuration for monitoring Crontab files:

[[inputs.configwatcher]]
  ## Required. A name for this collection task for identification.
  task_name = "Crontab"

  ## An array of file paths to monitor for changes.
  paths = [
      "/var/spool/cron/crontabs",
  ]

  ## The interval at which to check for changes.
  interval = "3m"

  ## Whether to recursively monitor directories in the provided paths.
  recursive = true

  ## The maximum file size (in bytes) for which to compute content diffs, default is 256KiB.
  max_diff_size = 262144

When you modify Crontab tasks using the crontab -e command in the Linux terminal, the collector will detect changes in the corresponding files.

FAQ¶

The collector ignores changes in file permissions and ownership, monitoring only content changes.
The timestamp for change events is taken from the file's ModTime, not the system time.
If the file size exceeds max_diff_size, the differences between old and new file contents are not compared.