One of my servers running a universal forwarder is spitting out this message quite frequently:
02-04-2016 16:48:49.607 -0500 INFO WatchedFile - Resetting fd to re-extract header.
What is this telling me? Each file does have a header, which we ignore via the FIELD_HEADER_REGEX parameter. Is it telling me that the header is being extracted? (These files roll over quite a bit).
↧