Support forum for Nagios Core, Nagios Plugins, NCPA, NRPE, NSCA, NDOUtils and more. Engage with the community of users including those using the open source solutions.
I know this is a question I could easily check in a test environment but I don't have one and I don't want to test in production
We have a lot of devices that get added and we want to monitor them in Splunk the same day. Spunk relies on the CURRENT HOST STATE in the log files and I believe this is always added at the top of new log files at midnight. So does that mean that if I change log file rotation to 1 hour a new current hosts state log is written every hour to each new log file?
And does anyone know if moving to hourly logs files affects passive polling (as I use NSCA a lot for various reasons)?
To my knowledge the CURRENT HOST STATE will be re-run for all hosts every time the log file is rotated, even if it's hourly. To my knowledge this is done to calculate reports and retention properly.
