Collecting Single-line Messages
When a file is collected, only the newly added logs at the end of the file are collected. Logs already available in a file before the LogLogic® Universal Collector log source creation are not collected.
LogLogic® Universal Collector operates by monitoring specified text files that are receiving log output from log sources. The log sources append new logs to the end of the text file as events occur.
As new records appear at the end of the monitored file, they are instantly taken into account by LogLogic® Universal Collector.
LogLogic® Universal Collector forwards single-line log messages to a LogLogic LMI or Syslog server.
LogLogic® Universal Collector uses cursors to track the monitored files and to resume continuously after having stopped.
The cursors have information about the file positions at which to restart - called metadata - and file identification information.
It can determine whether the file to be resumed is the file to which the saved position applies.
In other terms, even if the LogLogic® Universal Collector is stopped for a while, all messages contained in the file are collected by using the position cursors, no messages are lost.