What is Splunk Universal Forwarder caching functionality?

[inters]

Does anyone know the functionality for the Universal Forwarder and its caching of logs if its disconnected from the indexer. Specifically, what is the functionality of caching a file when it gets rotated to a zipped file while its still disconnected from the indexer?

Do we lose everything that got rotated to a zipped file? Or did everything still get cached, regardless of the log rotation happening or not?

[nickhills]

The UF achieves this, but not by caching.

If a UF is disconnected from the indexers, it simply stops sending data, but it remembers the "place it got to" before it was disconnected.

When the indexer is back online, the UF simply resumes sending from where it left off.

In the case of logs which rotate while the indexer is offline, assuming you monitor stanza does not exclude rolled files, you should still get the full content of the logs, but in these cases, the source name will likely reflect the name of the rolled file mylog.log.1 etc

[inters]

hmmmm, interesting. But assuming we do exclude the rolled files to avoid using unnecessary storage usage, then we would lose the part of the logs that got rolled over?