Watch Directory Troubleshooting

InsightIDR Event Sources
1

Hi all,
Setting up a new Watch Directory source, but its not pulling through events.
I have configured the network path (eg, \xxxx\yy\z) and set the appropriate credentials.
There is no error showing, it just shows “Running”.
I cant find a way to properly troubleshoot any issues here.
Connectivity between the collector and the Windows box in question shouldnt be an issue.
I even tried putting in non-working creds, but it still shows as Running!

Any pointers on how to t-shoot this?

Thanks,

2

Just to add - i am Tailing the “collector.log” on the Collector, but can see no reference to the Event Source that i have configured. I can see references to others, but not this new one i have created

3

Deleting it and re-creating the event source a few times seems to have fixed it…

4

Did you ever find a solution to this issue?