In message <[email protected]>,
Mike Rykowski writes:
>I'm new to SEC and just trying it out now. My log files are of the
>format blah-YYYY-MM-DD.log. I can write a script to change the date and
>restart the SEC process but that will lose state. Is there a way to
>handle this file name change on a daily basis without losing state?
Try this for linux. A similar mechanism should work for other
systems. (cut and pasted from another source):
Some processes create multiple log files that are date stamped or
otherwise uniquely named. SEC however wants a static name to be able
to follow the log file. The following rule allows you to have SEC
follow files where the most recent log file has a unique name.
* have sec follow a single input file (called current)
* identify newest of the log files
* see if the inode of that file is the same as current file
* if different, hard link file to current
* use a Calendar rule that fires every minute to check/create link
This rule identifies the most recent file in the log directory and
hard links it to the file named current in the working directory of
the SEC process. The directory holding the file current is writable by
the user running the SEC process while the parent directory is not
writable to the SEC user.
#****v* calendar/relink_current
# SYNOPSIS
# relink_current - created hard link to newest log file in the parent directory
# DESCRIPTION
# Every minute find the most recently written log file in the parent
# directory and obtain its inode number. Obtain the inode number of
# the file current (which must exist). If they have the same inode
# number, exit status 0. If they don't force current to be linked to
# the most recently written log file.
#******
type = calendar
time = * * * * *
desc = relink current file
action = shellcmd (/bin/sh -c 'lastfile=`ls -tr .. | grep '\\.log\$' \
| tail -n 1`; [ `stat --printf "%i" current` -eq \
`stat --printf "%i" ../$lastfile` ] || \
ln -f ../$lastfile current')
[note I split the command line to stop it from being butchered by
email. It should be all on one line.]
The shellcmd identifies the last log file by listing the parent
directory with the files sorted by date. The grep limits the file list
to log files. The tail then selects just the last file. The test
command uses stat to see if the inodes for the current and last file
are the same. If they are not, the current file is forcibly replaced
with a link to the newest log file.
Since SEC follows the current file until there is no more input it
will process the old log file to the end. Then when there is no more
data, it detects that the current file has changed and starts
processing it from the beginning. No events should be lost, but the
processing of data in the new log file can be delayed by up to a
minute.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
