Changing the agent configuration and format files
The OS agent reads its configuration (.conf) and format (.fmt) files when it starts, and monitors their time stamp every 60 seconds thereafter.
If the time stamp of the configuration or format file changes, the agent reinitializes its configuration dynamically, without requiring a restart. During reinitialization, monitoring is interrupted momentarily. When monitoring resumes, the agent must determine the position in the monitored logs from which to restart. As a result, the agent behaves in the same way as a full stop and restart.
Log File RegEx Statistics, Log File Status, and Log File
Event attribute groups.By default, the agent starts monitoring from the end of
the file, when the reinitialization completes. This starting position
can cause events that occurred during the interruption of monitoring
to be missed. To ensure that such events are picked up when monitoring
resumes, use the NumEventsToCatchUp=-1 setting.
Setting NumEventsToCatchUp=-1 causes a position file to be maintained. The
position file is updated each time that the agent reads the log file. The update saves the position
of the agent in the log file, in case of an agent restart. Maintaining the position file has a small
performance impact, so maintain this file only if required. For more information about
NumEventsToCatchUp, see Configuration file.