I have an issue with two servers with WebSphere logs that have a overriding different timezone setting in the jvm. Other servers don't have an issue. To prevent wrong interpretation of timestamps, I want to add to the props.conf something like:
1. using specific hosts [host::server1|server2] ór based on the logfile [source::/opt/data/WebSphere/logs/log.log]
2. DATETIME_CONFIG=NONE
But you can't of course somehow filter host AND source/sourcetype. Using only host would make other (performance/OS) events useless and unreliable; using only source would affect all the other logfiles from multiple other servers.
It's not only datetime related; I also'd like to be able to break_only_before/after some logfiles from specific host (think like, some end with <END>, other must be broken before datetime)
So in general is the question: how can you use some local props.conf settings for specific sources/sourcetypes on specific hosts?
↧
How to configure props.conf to set specific Datetime-configs on specific source from specific hosts?
↧