Generally the size of a file should not affect software which just writes at the end of the file or reads there. Of course the bigger a file is, the more time you need to read it whole but that's obvious. If you wanted to cache a whole file in memory (why would you do that?) then the size would matter. Maybe if you used some ancient filesystem the size would matter. With a modern OS the file size doesn't really affect reading/writing performance. BTW, with modern syslog daemons you can write directly to HEC input and skip local files altogether (which takes the PITA of maintaining the log rotation scripts, monitoring free space and so on). ... View more

Thanks Sir Gcusello, it worked  ... View more