2 Replies Latest reply on May 12, 2014 11:42 PM by raylite3

Can log messages be missed when it rolls over?

raylite3 May 7, 2014 6:21 PM

Hi,

How does the log event source create the events from the log file? Does the agent scan the log file periodically? If so, isn't it possible to lose messages when the file rolls over?

Thanks in advance !

1. Re: Can log messages be missed when it rolls over?

genman May 8, 2014 3:56 PM (in response to raylite3)

Looking at LogFileEventPoller, I would say no. If the file is renamed, it will miss the last part.

You can probably get more reliable results using the Syslog port monitoring.

There's been talk of using a different log monitoring system as well as moving events to Elasticsearch. Not sure if any progress is happening in the short term.
Actions
2. Re: Can log messages be missed when it rolls over?

raylite3 May 12, 2014 11:42 PM (in response to genman)

So it is possible to miss the last part of the log file if it rolls in between the polls ?

Does RHQ currently support ELK or are there plans to support it?
Actions

Go to original post