I recently edited the path of a source in inputs.conf in a heavy forwarder but I kept receiving events from both ( the new and the old source ).
the old one :
[monitor:///var/portal/tomcat/log/jms.log]
disabled = false
index = APP_Cle
sourcetype = APP_jms
I edited the file then it became :
[monitor:///var/portal/local/log/jms.log]
disabled = false
index = APP_Cle
sourcetype = APP_jms
Is this normal ? What should I do to stop receiving events from the old source ?
↧