On 01/25/2011 05:51 PM, M Haris Farooque wrote: > > Hi all, > > I just like to know, what will happen when a file (data.log) is rotated > automatically which is actually hooked with SEC_STARTUP event as shown > in following rule definition. > > /type=single > ptype=substr > pattern=SEC_STARTUP > continue=TakeNext > context=SEC_INTERNAL_EVENT > desc=$0 > action= spawn /usr/bin/tail -f /var/log///data.log > / > like in my case, data.log is rotated automatically when the file size > exceeds 1GB. It is moved/renamed (as timestamp is appended at the end of > its name) and new file 'data.log' (of 0 byte) is touched. > > do SEC continue operating with the new file without problem?
...as John just mentioned, -f does not help indeed, since it does not enforce following the file by name. However, why not to follow this file with the --input command line option? SEC has a builtin support for log file rotation handling :) regards, risto > > thanks > > -- > > Kind Reagrds/Mit freundlichen Grüßen > > M Haris Farooque > > > > ------------------------------------------------------------------------------ > Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)! > Finally, a world-class log management solution at an even better price-free! > Download using promo code Free_Logger_4_Dev2Dev. Offer expires > February 28th, so secure your free ArcSight Logger TODAY! > http://p.sf.net/sfu/arcsight-sfd2d > > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)! Finally, a world-class log management solution at an even better price-free! Download using promo code Free_Logger_4_Dev2Dev. Offer expires February 28th, so secure your free ArcSight Logger TODAY! http://p.sf.net/sfu/arcsight-sfd2d _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
