Getting Data In

Does atime (file access time) need to be up-to-date for the universal forwarder to monitor a file?

ryoji_solsys
Explorer

Hi there,

Would someone tell me if I can disable atime update for logs monitored by a universal forwarder?
Even though atime is not being updated, can the forwarder correctly monitor and splunk the logs?

Thanks

1 Solution

mreynov_splunk
Splunk Employee
Splunk Employee

Splunk uses CRC for monitoring files: http://docs.splunk.com/Documentation/Splunk/6.0.5/Data/Howlogfilerotationishandled
so disabling atime should not cause any problems.

View solution in original post

vliggio
Communicator

Not quite a complete and correct answer by mreynov. Splunk uses a lot of different things besides CRC for file monitoring (atime is not one of them). For example, it uses mtime and size to determine if it has indexed a file and for the ignoreOlderThan option.

In general there is no need for atime on most systems unless you need to know if a file was accessed at a specific time. That's why most modern file systems in Linux use relatime as the default mounting option (so your atime is probably already not being updated more than once a day).

So go ahead and mount as noatime if you need zero updates, or relatime if you want sane updates (when file is changed or once a day).

0 Karma

mreynov_splunk
Splunk Employee
Splunk Employee

Splunk uses CRC for monitoring files: http://docs.splunk.com/Documentation/Splunk/6.0.5/Data/Howlogfilerotationishandled
so disabling atime should not cause any problems.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...