Feature #259
option to force prelude-lml to start at the end a log regardless on metadata
0%
Description
a option to always start at the end of a log file regardless of metadata would be a nice feature to have. currently if for any reason an instance of prelude-lml is down on any host in my environment during a production day my operations staff will not restart the process until end of day due to the fact that when the process starts it jumps to 100% utilization of a cpu until it catches up. In this case it is often more important to get the monitoring back up and running then to find out what transpired while the prelude-lml process was down. in the case of some of the applications we are using it to monitor some of these log files grow to up to 90GB's over the course of an 8 hour day, so even a short outage could cause a to take several minutes to catchup so I can understand their reluctance.
History
#1 Updated by Yoann VANDOORSELAERE over 15 years ago
- Status changed from New to Assigned
#2 Updated by Yoann VANDOORSELAERE over 15 years ago
- Status changed from Assigned to Closed
- Resolution set to fixed
Fixed in r10080.
#3 Updated by Yoann VANDOORSELAERE about 14 years ago
- Project changed from PRELUDE SIEM to Prelude-LML
- Category deleted (
4) - Target version deleted (
0.9.11)