Hi all,
I just like to know, what will happen when a file (data.log) is rotated automatically which is actually hooked with SEC_STARTUP event as shown in following rule definition.
/type=single ptype=substr pattern=SEC_STARTUP continue=TakeNext context=SEC_INTERNAL_EVENT desc=$0 action= spawn /usr/bin/tail -f /var/log///data.log /like in my case, data.log is rotated automatically when the file size exceeds 1GB. It is moved/renamed (as timestamp is appended at the end of its name) and new file 'data.log' (of 0 byte) is touched.
do SEC continue operating with the new file without problem? thanks -- Kind Reagrds/Mit freundlichen Grüßen M Haris Farooque
------------------------------------------------------------------------------ Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)! Finally, a world-class log management solution at an even better price-free! Download using promo code Free_Logger_4_Dev2Dev. Offer expires February 28th, so secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsight-sfd2d
_______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
