I would just like to know if it is necessary to back up the UF fishbucket. Is there any reason I would need to restore it other than not indexing log data more than once?
The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...
If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...
The short answer is no.
The fishbucket exists to keep track of which files have been read by the forwarder, you can stop the forwarder delete it & it will be re-created when the forwarder starts up again. Of course if it is deleted the forwarder will re-read all the monitored files and likely duplicate data within your system...
If you do correctly restore the fishbucket (assuming it did not have in flight changes occurring!) then that would prevent the data duplication problem...
