hi Alberto,

if the input file has been provided to SEC with --input command line
option, there is currently no way to close it. (It is only possible to
increase the status polling time frame for input files with --check-timeout
option, in order to reduce the system load if there is a large number of
infrequently modified inputs.)

However, if the input file has been set up with 'addinput' action, it is
possible to execute 'dropinput' action for this file which closes it and
removes from the list of inputs. There are two ways how to potentially
trigger the execution of 'dropinput' action. Firstly, one could use a
context for closing the file, where context lifetime is extended on each
event that appears in the input file, and 'dropinput' gets executed when
the context expires. A slightly different context-based example has been
provided in SEC FAQ, where a file is kept open for a specific date and
closed when the day ends:
http://simple-evcorr.github.io/FAQ.html#24

There is also another approach -- with --input-timeout=N and
--timeout-script=S options, one can execute an external script S if no
events have been observed in input file during the last N seconds. From
that script, it is possible to write a message to control file or FIFO
which is monitored by SEC, and have a rule which matches that message and
executes 'dropinput' action. (The same control file could be utilized for
other purposes, such as reloading configuration and log rotation:
http://simple-evcorr.github.io/FAQ.html#26.)

kind regards,
risto



Kontakt Alberto Corton Padilla (<acor...@s21sec.com>) kirjutas kuupƤeval R,
4. oktoober 2019 kell 16:58:

> Hi,
>
> Is there a way to close an input file if no new lines have been written
> for a specified duration?
>
> Regards,
>
>
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users

Reply via email to