In our non-prod environment, some files are not written to on a regular basis. In these cases the UF often needs to be restarted to start the ingestion of events.
The monitor stanza in use is very basic and does not have an 'ignoreOlderThan' value set.
Here is an example -
[monitor:///my_non_prod_path/Log/app.log]index=my_non_prod_indexsourcetype = nonprd_sourcetypedisabled=false
Are there global variables that would override this and cause events to not be ingested?
there are so many reasons for not reading file using monitor input.
worth reading below:
View solution in original post
Thanks for the link. It makes interesting reading. I have asked our unix SA to add debugging to the UF so I can get more details.
Events from different files on the server in question are being ingested and the same file name on a different server is also providing events.