Project

General

Profile

Feature #259

option to force prelude-lml to start at the end a log regardless on metadata

Added by prmarino1-gmail-com - almost 12 years ago. Updated over 10 years ago.

Status:
Closed
Priority:
Normal
Target version:
Start date:
Due date:
% Done:

0%

Resolution:
fixed

Description

a option to always start at the end of a log file regardless of metadata would be a nice feature to have. currently if for any reason an instance of prelude-lml is down on any host in my environment during a production day my operations staff will not restart the process until end of day due to the fact that when the process starts it jumps to 100% utilization of a cpu until it catches up. In this case it is often more important to get the monitoring back up and running then to find out what transpired while the prelude-lml process was down. in the case of some of the applications we are using it to monitor some of these log files grow to up to 90GB's over the course of an 8 hour day, so even a short outage could cause a to take several minutes to catchup so I can understand their reluctance.

History

#1 Updated by Yoann VANDOORSELAERE over 11 years ago

  • Status changed from New to Assigned

#2 Updated by Yoann VANDOORSELAERE over 11 years ago

  • Status changed from Assigned to Closed
  • Resolution set to fixed

Fixed in r10080.

#3 Updated by Yoann VANDOORSELAERE over 10 years ago

  • Project changed from PRELUDE SIEM to Prelude-LML
  • Category deleted (4)
  • Target version deleted (0.9.11)

Also available in: Atom PDF