How to use rsync to move frozen data to another location?

[mdtoro]

I was looking at rsync to move some frozen buckets to another location.  One concern,  if rsync picks up new frozen data still being written  and removes the source file before splunk finishes.

I could add find and mtime but this really slows down rsync.

Concerns?

[mdtoro]

I was thinking it is easier to not touch anything recently created.  Create a list of files at least 2 days old.

[richgalloway]

That could work, too.

[richgalloway]

Consider using lsof to test if the file is still open before moving it.