There isn't a simple workaround, because input file pattern can not be constantly evaluated, in order to see if new files have appeared or not. One solution would be to let SEC deliver itself the SIGABRT signal from the Calendar rule (e.g., once in 5 minutes) which will cause SEC to reopen its log and inputs without dropping event correlation state. However, during reopen SEC always jumps to the very end of each input, so there is a slight risk of data loss. Since in your case there are only 5 log files, I would recommend write -input options for them explicitly in the command line. You can then also take advantage of the -reopen_timeout option which handles the case of non-existing log file. kind regards, risto
On 03/16/2010 10:46 PM, fedora fedora wrote: > yes, i am pretty sure all those logfiles were there, on the other hand, > there is a log rotation control in place, will this affect it? if that > is the case, is there any workaround for that? > > > On Tue, Mar 16, 2010 at 11:08 AM, Risto Vaarandi <risto.vaara...@seb.ee > <mailto:risto.vaara...@seb.ee>> wrote: > > On 03/16/2010 03:27 PM, fedora fedora wrote: > > i have about 5 different logfiles under /opt/app and i want sec to > > monitor all of them at the same time, the following is the > command i use > > > > /usr/bin/perl -w /usr/local/bin/sec.pl <http://sec.pl> > <http://sec.pl> > > -input=/opt/app/log/*.log -conf=/etc/sec.conf -detach > > > > SEC does not complain, but i noticed it only monitors the first > log file > > under /opt/app/log, not all of them > > > > So what can i do to let sec monitor all the *.log files under > /opt/app/log? > > > > Thanks in advance! > > SEC expands the file metacharacters for -input option -- however, this > is done only at startup and at the reception of HUP signal. Please note > that if there is only one logfile present at this time, SEC will open > only this file. Are you sure that all logfiles exist when SEC is > started? > BR, > risto > > > > > FD > > > > > > > > > > ------------------------------------------------------------------------------ > > Download Intel® Parallel Studio Eval > > Try the new software tools for yourself. Speed compiling, find bugs > > proactively, and fine-tune applications for parallel performance. > > See why Intel Parallel Studio got high marks during beta. > > http://p.sf.net/sfu/intel-sw-dev > > > > > > > > _______________________________________________ > > Simple-evcorr-users mailing list > > Simple-evcorr-users@lists.sourceforge.net > <mailto:Simple-evcorr-users@lists.sourceforge.net> > > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > > > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > <mailto:Simple-evcorr-users@lists.sourceforge.net> > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > > > > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
