Our system is generating log files named stdout.{pid}.log, the 'pid' here is the process id of current login session, and the log file will be reused when system reusing same pid, and it will overwrite the log file rather than appending at the tail. currently we found sometimes the entries on splunk are incomplete when it's overwriting by sytem.
i.e. system generated a stdout.27797.log on 25th Mar, and the whole content can be found on splunk. but when system overwriting this log file on 26 Mar, we only find the first 2 lines of the file on splunk, seems this file is indexed but splunk just can't collect all the content in it.
the configuration of input.conf:
[monitor:///testing/stdout.*.log]
index= efxfxomurexraw
sourcetype = efxfxomurexstdout_live
ignoreOlderThan = 7d
crcSalt = <SOURCE>
OS: Solaris 10.
