You may want to gather logs for which rotation is configured. This section explains how to specify the names of such logs for successful gathering.
The typical configuration for log rotation is as follows:
In such situations, you do not want to gather the current log. On the Path to Custom Text Log step of the wizard, explicitly specify one of the backup logs that does not get updated. For example, if rotation is set up for log files log.1 to log.5, supply log.2 as the log file name.
This is required so that gathered events are not duplicated and no events are missed due to the rotation cycle.
If rotation takes place on schedule, set gathering to occur as frequently as the rotation sessions or more frequently.
If rotation happens whenever the current log is at capacity, configure the gathering to take place as often as possible. This way, you will not skip a file due to a sudden increase in the number of events. Performance will not suffer if you gather often, because InTrust does not collect the same events from the same log a second time. In such a configuration, a log file is collected only once in its entirety. All other InTrust gathering sessions simply check whether the file has been replaced.
To use a text log data source in a new gathering policy
In this example, you will create a working data source that handles gathering of the Squid proxy server’s access log. The Squid access log can have three formats. This example uses the access log native format which is the default format.
Before running the New Data Source Wizard, make sure there is sample log file in a location that is accessible from the wizard. The directory /var/log/squid/ where the file access.log resides cannot be accessed directly from InTrust Manager. Copy the file to a local folder on the computer where InTrust is running, for example C:\Logs.
To create a data source for the Squid access log