Tomcat 7.0 Logs on Windows Server 2012 R2

[martineisenkoel]

Hi,

I'm pretty new to using the universal forwarder on Windows Servers.
Our indexer Server is running on 7.2.0 and the used Forwarders version is 7.2.1.

I've added a straight forward monitor (pls see inputs.onf below) to the Tomcat log dir but indexing these events get interrputed daily between 10pm and 12pm.
Thats the time when the tomcat log files are getting rotated. Suprisingly for myself splunks knows about the newly created file but didnt start to index until I restart the Forwarder service.

Since Windows isnt changing the mod/creation/access dates I guessed that the Forwarder simply doesnt knows about a change to the file and tried - alwaysOpenFile=1 - but without success, same behaviour.

Perfmon and several other logs form the server are index correctly and contionously.

Please also see config files below.
Many thanks in advance!

Regards,
Martin

Inputs.conf of the app

[default]
ignoreOlderThan = 7d

[monitor://D:\Program Files\Apache Software Foundation\Tomcat7.0\logs\*]
alwaysOpenFile=1
disabled = false


[monitor://D:\Program Files\BMC Software\ARSystem\midtier\logs\*]
alwaysOpenFile=1
disabled = false

[renjith_nair]

@martineisenkoelbl ,

While the log rotation happens , normally it rotates the old log, compresses/archives and creates a new file with the same name. But since Splunk still has the file handler opens to the old log file during the time of rotation, it still looks at the old file for new entries.

Unless you restart Splunk, it does not now about the new file. So either you need to restart splunk or change the log rotation mechanism to keep the original file by moving the old content to a different file.

[martineisenkoel]

the newly created log file is named with the actual date so names are always uniqe.
Thats the std. tomcat accesslog mechanism I think.

D:\\Program Files\\Apache Software Foundation\\Tomcat7.0\\logs\\localhost_access_log.2018-11-28.txt

Also splunks lists the new file as source in web search but theres no log entry indexed.