How Forwarder Keep Track sent data/log

[kpavan]

Hi All,

Need info on below,

> How forwarder keep a track of sent data/log to indexer and do we have to configure such a way it should not send the data which is already sent and indexed
> How indexer will keep a track of collected/indexed log and will not accept the same log.

Thanks,
Pavan

[gfuente · Accepted solution]

Hello

1) The forwarder has an special index called _fishbucket where it store the information of the files already monitored. Then for each file keeps a track of the first 256 bytes of the file, and the last position readed. With this information the UF controls which data is new and needs to be forwarded

2) The indexer doesn't know nothing about what data is already indexed, so it will index any incoming data sent by any forwarder. For example if you uninstall and install again a UF and configure it to monitor the same logs, they will be reindexed.

Regards