UFs new pointer after restart

[hectorvp]

If I gracefully shutdown the UF, it will send all logs from output queue and from internal parsing queue.

Suppose I restart the UF after 1min, will it start sending logs from logs file where he had left before shutdown???  

Or will it start sending new logs which are getting appended independent of where had left off.

If in such scenarios logs are getting dropped, is there any way to detect how many such logs were dropped? 

What may happen if UF is crashed, obviously it will drop queue logs but from where he would start once he is up and running??

[richgalloway · Accepted solution]

When the UF starts, it resumes reading log files from where it left off.

If the UF crashes, data read and not sent is lost unless indexer acknowledgment is used.

[hectorvp]

@richgalloway 

Then if UF crashes and we restore it by some means and again UF is up and running ,although UF dropped events which was read but then from where he would start reading new events from the file??

Again would UF start from where he had left off??

[richgalloway]

The UF will start from the last file position it saved.