Getting Data In

incomplete log for overwriting log file

zhengzhi163
New Member

Our system is generating log files named stdout.{pid}.log, the 'pid' here is the process id of current login session, and the log file will be reused when system reusing same pid, and it will overwrite the log file rather than appending at the tail. currently we found sometimes the entries on splunk are incomplete when it's overwriting by sytem.
i.e. system generated a stdout.27797.log on 25th Mar, and the whole content can be found on splunk. but when system overwriting this log file on 26 Mar, we only find the first 2 lines of the file on splunk, seems this file is indexed but splunk just can't collect all the content in it.

the configuration of input.conf:

[monitor:///testing/stdout.*.log]
index= efx_fxomurex_raw
sourcetype = efx_fxomurex_stdout_live
ignoreOlderThan = 7d
crcSalt = <SOURCE>

OS: Solaris 10.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...