Question
Why does Cribl Stream File Monitor attempt to open unrelated subdirectory when Filename allowlist targets a file (e.g. /var/log) in the directory and Max depth is 0?
Environment
- Cribl Stream or Edge File Monitor source
- Manual discovery mode on a Linux host
- Max depth configured as
0
Answer
File Monitor discovers filesystem entries under Search path before applying Filename allowlist.
The allowlist filters files, not directories, so File Monitor can still call opendir on a subdirectory. If the Cribl service account lacks read permission, the source logs EACCES: permission denied.
For a single target file, use its full path in both Search path and Filename allowlist. For example, use /var/log/messages in both fields.
Additional Information
See the File Monitor Source documentation for discovery, search-path, maximum-depth, and filename-allowlist behavior.