topic Re: UFs new pointer after restart in Getting Data In

UFs new pointer after restart

hectorvp — Fri, 25 Sep 2020 19:41:48 GMT

If I gracefully shutdown the UF, it will send all logs from output queue and from internal parsing queue.

Suppose I restart the UF after 1min, will it start sending logs from logs file where he had left before shutdown???

Or will it start sending new logs which are getting appended independent of where had left off.

If in such scenarios logs are getting dropped, is there any way to detect how many such logs were dropped?

What may happen if UF is crashed, obviously it will drop queue logs but from where he would start once he is up and running??

Re: UFs new pointer after restart

richgalloway — Fri, 25 Sep 2020 20:24:41 GMT

When the UF starts, it resumes reading log files from where it left off.

If the UF crashes, data read and not sent is lost unless indexer acknowledgment is used.

Re: UFs new pointer after restart

hectorvp — Sat, 26 Sep 2020 15:37:09 GMT

@richgalloway

Then if UF crashes and we restore it by some means and again UF is up and running ,although UF dropped events which was read but then from where he would start reading new events from the file??

Again would UF start from where he had left off??

Re: UFs new pointer after restart

richgalloway — Sat, 26 Sep 2020 16:39:36 GMT

The UF will start from the last file position it saved.