Indexing a file that was rotated midstream

[tafiedler]

The /var/log/messages file on one of my syslog servers was being forwarded by Splunk Universal Forwarder, as witnessed by watching the summary page and paying attention to the count, when the logrotate rotated the file to /var/log/messages-20120903. This file had 87 million lines in it and I know it was not finished at the time it was rotatated. My inputs.conf is wathing only the /var/log/messages file.

My question is, will Splunk continue to forward the contents of the rotated file to the indexer or will it now start forwarding events in the newly created /var/log/messages file?

Thanks,
Todd

[Ayn]

If you set up the monitor to only read /var/log/messages, then that's the only file that Splunk is going to read. If you set it up to read the other files that messages is rotated into though (like /var/log, /var/log/messages*), Splunk will read the rotated files as well as long as they're not events that have already been seen before. Here's some info on how Splunk handles rotated files: http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled