How Forwarder Keep Track sent data/log

kpavan — Wed, 13 May 2015 12:35:58 GMT

Hi All,

Need info on below,

> How forwarder keep a track of sent data/log to indexer and do we have to configure such a way it should not send the data which is already sent and indexed
> How indexer will keep a track of collected/indexed log and will not accept the same log.

Thanks,
Pavan

Re: How Forwarder Keep Track sent data/log

gfuente — Wed, 13 May 2015 12:46:24 GMT

Hello

1) The forwarder has an special index called _fishbucket where it store the information of the files already monitored. Then for each file keeps a track of the first 256 bytes of the file, and the last position readed. With this information the UF controls which data is new and needs to be forwarded

2) The indexer doesn't know nothing about what data is already indexed, so it will index any incoming data sent by any forwarder. For example if you uninstall and install again a UF and configure it to monitor the same logs, they will be reindexed.

Regards

topic How Forwarder Keep Track sent data/log in Getting Data In

How Forwarder Keep Track sent data/log

Re: How Forwarder Keep Track sent data/log