Merge pull request #51 from HubbleStack/develop

Merge to master (prep v2016.10.2)

README.rst

@@ -240,6 +240,27 @@ defined path.
         - /var/cache
         - /var/lock
 
+
+Troubleshooting
+===============
+
+If inotify is reporting that it can't create watches due to lack of disk space,
+but you have plenty of disk space and inodes available, then you may have to
+raise the max number of inotify watches.
+
+To check the max number of inotify watches:
+
+.. code-block:: bash
+
+    # cat /proc/sys/fs/inotify/max_user_watches
+
+To set the max number of inotify watches:
+
+.. code-block:: bash
+
+    # echo 20000 | sudo tee -a /proc/sys/fs/inotify/max_user_watches
+
+
 .. _pulsar_under_the_hood:
 
 Under The Hood

_beacons/pulsar.py

@@ -39,6 +39,7 @@
     DEFAULT_MASK = None
 
 __virtualname__ = 'pulsar'
+__version__ = 'v2016.10.2'
 CONFIG = None
 CONFIG_STALENESS = 0
 

_beacons/win_pulsar.py

@@ -25,6 +25,7 @@
 DEFAULT_TYPE = 'all'
 
 __virtualname__ = 'pulsar'
+__version__ = 'v2016.10.2'
 CONFIG = None
 CONFIG_STALENESS = 0
 

hubblestack_pulsar/hubblestack_pulsar_config.yaml

@@ -16,6 +16,8 @@
     - /opt/splunk/var/
     - /opt/cloudpassage/log/
     - /opt/splunkforwarder/var/
+    - '\/opt\/imply-\d\.\d\.\d\/':
+        regex: True
   recurse: True
   auto_add: True
 /etc: