Nagios Support Forum

I know this is a question I could easily check in a test environment but I don't have one and I don't want to test in production

We have a lot of devices that get added and we want to monitor them in Splunk the same day. Spunk relies on the CURRENT HOST STATE in the log files and I believe this is always added at the top of new log files at midnight. So does that mean that if I change log file rotation to 1 hour a new current hosts state log is written every hour to each new log file?

And does anyone know if moving to hourly logs files affects passive polling (as I use NSCA a lot for various reasons)?

Thanks

--Chris

To my knowledge the CURRENT HOST STATE will be re-run for all hosts every time the log file is rotated, even if it's hourly. To my knowledge this is done to calculate reports and retention properly.