Getting Data In

Behaviour of containerized universal forwarder on restart

New Member

Dear all,

despite my best efforts, I was not able to find satisfactory information. Thus I would like to ask if anyone here can help me with this.

We have the UF running in a docker container in a k8s environment. For getting data in, we are using batch/monitor on files stored on a persistant volume claim.

Consider the following scenario:

- The container the UF is running in gets restarted while the UF is processing a file. After booting back up, the UF re-processes the entire file, leading to duplicates on the indexer

Is this something we need to consider, for example by checking that the UF is currently not processing anything before restarting? Or will the UF take care of all of this for us?

Labels (3)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!