By all means somebody prove me wrong - but by experimentation and debug lines added to logfetch I am stating that the MAX chunk of a logfile that will ever be examined is
#define MAXCHECK 102400 /* When starting, dont look at more than 100 KB of data */
The man page says -
The log:FILENAME:SIZE line defines the filename of the log, and the maximum amount of data (in bytes) to send to the Xymon server.
and that may be true. I did not investigate how much of the 102400 was sent to the xymon server. My trigger string was not in the lower 102400 bytes of the file and no matter what I made SIZE the trigger was never found. Also note the chunk of the file inspected never changed, no matter what the SIZE was.
It seems to me the lower 102400 bytes (or how ever much you have?) is inspected - no matter what the SIZE value is. The chunk inspected seems to include ignored lines. So you don't get more file inspected if you have ignore lines, I guess you just have less crud in the data going to the xymon server.
Given a test case where
log:/home/devtestge/fake.log:202400
when I increased MAXCHECK and recompiled, the chunk examined increased. The was the only way the the chunk examined increased.
Next I want to find out how big brother did this, so there are no nasty surprises when I move off the big brother client to the xymon client.
-- Bakkies