Natalia,
Do you know the filenames in advance? If so, you can take advantage of the
--reopen-timeout commandline option. For example, if you start sec with the
following options
sec --input=/var/log/mylog --reopen-timeout=60 ...
and /var/log/mylog does not exist at sec startup, its presence will be
checked after each 60 seconds. When the file appears, it will be opened and
processed from the beginning.
Hope this helps, risto
On Aug 20, 2014 10:24 AM, "Natalia Iglesias" <
nigles...@lookwisesolutions.com> wrote:
> Hello everyone,
>
> We are experiencing the following problem: we start SEC once a day at
> 00:00 hours, so all new files created at that point will be considered as
> input files for SEC rules. However it is possible that new files are
> created later on during the day, so how can we let SEC automatically
> include them for rule processing without stopping/starting SEC (which would
> cause as side-effect that previously processed input files would be
> processed again).
>
>
>
> Thanks in advance!
>
>
>
> Best regards,
>
>
>
> Natalia Iglesias
>
------------------------------------------------------------------------------
Slashdot TV.
Video for Nerds. Stuff that matters.
http://tv.slashdot.org/
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
