If the IP address for a host changes or if it gets a new GUID, would the forwarder resend the entire Windows event log?
It depends.
If you uninstalled the old forwarder and then reinstalled the new one, it’s quite possible that it will re-read and send all the logs.
If you upgraded the forwarder this should not occurr, even if the ip or guild changes.
It depends.
If you uninstalled the old forwarder and then reinstalled the new one, it’s quite possible that it will re-read and send all the logs.
If you upgraded the forwarder this should not occurr, even if the ip or guild changes.
I noted “possible” because depending on your config, it may elect to only send evens which are older than x days, or in the case of windows events, only while the forwarder is running. Neither of these are default config, and have drawbacks.
Is your forwarder resending event logs again? Has any specific activity was performed on your UF like version upgrade?
The forwarders are resending event logs. We upgraded them from 6.4.4 to 6.4.9. Would the upgrade cause logs to be resent?
It should'nt. How did you do the upgrade (procedure)? Was it it inline with what this Splunk documentation suggests?
https://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/UpgradetheWindowsuniversalforwarder#...
I asked the folks who performed the upgrade and they told me they do uninstall the 6.4.4 version before installing 6.4.9. So that's probably what caused the logs to be resent, would you agree?
Yes. In that case I would say it’s expected behaviour
Okay, thank you.
I converted my comment to an answer, so you can accept it if it helped