Getting Data In

incomplete log for overwriting log file

New Member

Our system is generating log files named stdout.{pid}.log, the 'pid' here is the process id of current login session, and the log file will be reused when system reusing same pid, and it will overwrite the log file rather than appending at the tail. currently we found sometimes the entries on splunk are incomplete when it's overwriting by sytem.
i.e. system generated a stdout.27797.log on 25th Mar, and the whole content can be found on splunk. but when system overwriting this log file on 26 Mar, we only find the first 2 lines of the file on splunk, seems this file is indexed but splunk just can't collect all the content in it.

the configuration of input.conf:

[monitor:///testing/stdout.*.log]
index= efx_fxomurex_raw
sourcetype = efx_fxomurex_stdout_live
ignoreOlderThan = 7d
crcSalt = <SOURCE>

OS: Solaris 10.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!