topic Re: FSChange: fullEvent=true but no full event? in Getting Data In

FSChange: fullEvent=true but no full event?

muebel — Wed, 22 Sep 2010 02:53:11 GMT

I have a fschange stanza configured as such

[fschange:/path/to/file]
disabled = false
pollPeriod = 300
fullEvent = true
hashMaxSize = 65535

It seems to be detecting changes to this file, but doesn't include the file as I am expecting fullEvent = true would do. What am I missing?

Re: FSChange: fullEvent=true but no full event?

Simeon — Wed, 22 Sep 2010 02:57:17 GMT

If something changed, you should see the file displayed depending on the search criteria. The best way to find it would be to search for:

index=* source=/path/to/file*

I would be curious to know the exact fschangemonitor output when you run your initial search. Additionally, you may have the sendEventMaxSize set to something too low. If you set it to -1 under the stanza, it should pick up the file:

sendEventMaxSize=-1

Re: FSChange: fullEvent=true but no full event?

muebel — Wed, 22 Sep 2010 02:59:28 GMT

sendEventMaxSize defaults to -1

Re: FSChange: fullEvent=true but no full event?

muebel — Wed, 22 Sep 2010 03:02:21 GMT

I misunderstood how this was working out... did a search for the file as a source, and was able to see the full file there.