https://community.splunk.com/t5/Monitoring-Splunk/monitoring-log-truncated/m-p/415865#M6274 <P>It always send information from the last line that was generated.<BR /> If universal forwarder is monitoring the file named "hola.log" will monitor every line that was generated, after being empty or at leats all the lines goes to new "hola.log"</P> <P>EDiT: you will never lost logs. i leave you this link that can help you to understand best practices about log rotation <A href="https://answers.splunk.com/answers/577144/about-log-rotation-best-practices.html">https://answers.splunk.com/answers/577144/about-log-rotation-best-practices.html</A></P> <P>Let me know if i answer your question.</P> Wed, 06 Mar 2019 15:23:49 GMT jnahuelperez35 2019-03-06T15:23:49Z https://community.splunk.com/t5/Monitoring-Splunk/monitoring-log-truncated/m-p/415864#M6273 <P>We have a service where logs are truncated. Example, we have hola.log that fridays copy all content to new file hola20190306.log and hola.log is empty.</P> <P>My question, if universal forwarder monitoring hola.log, send info from begin or from position of the last event before truncated? Lost some events?</P> <P>Sorry my english is not very good</P> <P>Thank you in advance</P> Wed, 06 Mar 2019 15:02:18 GMT https://community.splunk.com/t5/Monitoring-Splunk/monitoring-log-truncated/m-p/415864#M6273 rjfv8205 2019-03-06T15:02:18Z https://community.splunk.com/t5/Monitoring-Splunk/monitoring-log-truncated/m-p/415865#M6274 <P>It always send information from the last line that was generated.<BR /> If universal forwarder is monitoring the file named "hola.log" will monitor every line that was generated, after being empty or at leats all the lines goes to new "hola.log"</P> <P>EDiT: you will never lost logs. i leave you this link that can help you to understand best practices about log rotation <A href="https://answers.splunk.com/answers/577144/about-log-rotation-best-practices.html">https://answers.splunk.com/answers/577144/about-log-rotation-best-practices.html</A></P> <P>Let me know if i answer your question.</P> Wed, 06 Mar 2019 15:23:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/monitoring-log-truncated/m-p/415865#M6274 jnahuelperez35 2019-03-06T15:23:49Z