we have added below line in the env_file, so that events will be catpured and ease to identifier the sourcetype.
SC4S_DEST_GLOBAL_ALTERNATES=d_hec_debug
In version version 1.110.0, we could see all the incoming sourcetype on it as below
$ ls
cisco_asa fortinet_fortios nix_syslog sc4s_events sc4s_fallback vmware_esx zscaler_web
But in version 2.0 till 2.28.0, we failed to see any sourcetype listed on it with same configuration in above, the "debug" folder is not create even after restart the sever
[DEV][archive] $ ls
[DEV][archive] $ pwd
/apps/sc4s/archive
Any hints what the change in between the version 1 and version 2 that possible caused the debug mode failed? (events are showing in Splunk)
*we just do in place upgrade from version 1 to version 2 on same working servers. IF we moved back to version 1, the debug directories will showed agai
