splunk / splunk-ansible

Ansible playbooks for configuring and managing Splunk Enterprise and Universal Forwarder deployments
357 stars 186 forks source link

[UniversalForwarder 9.2.1] SPLUNK_TAIL_FILE env var does not consider log file rotation #863

Open flyattimes opened 3 weeks ago

flyattimes commented 3 weeks ago

We are using the SPLUNK_TAIL_FILE envvar to redirect splunkd.log content to stdout.

When splunkd.log is rotated to splunkd.log.1, the handle of SPLUNK_TAIL_FILE remains with splunkd.log.1 which means that no more logs are visible. When the log file is rotated, the handle should be released and assigned to the newly created splunkd.log