I'm pretty new to using the universal forwarder on Windows Servers.
Our indexer Server is running on 7.2.0 and the used Forwarders version is 7.2.1.
I've added a straight forward monitor (pls see inputs.onf below) to the Tomcat log dir but indexing these events get interrputed daily between 10pm and 12pm.
Thats the time when the tomcat log files are getting rotated. Suprisingly for myself splunks knows about the newly created file but didnt start to index until I restart the Forwarder service.
Since Windows isnt changing the mod/creation/access dates I guessed that the Forwarder simply doesnt knows about a change to the file and tried - alwaysOpenFile=1 - but without success, same behaviour.
Perfmon and several other logs form the server are index correctly and contionously.
Please also see config files below.
Many thanks in advance!
While the log rotation happens , normally it rotates the old log, compresses/archives and creates a new file with the same name. But since Splunk still has the file handler opens to the old log file during the time of rotation, it still looks at the old file for new entries.
Unless you restart Splunk, it does not now about the new file. So either you need to restart splunk or change the log rotation mechanism to keep the original file by moving the old content to a different file.