|
A single log file needs to be monitored for more than a dozen unique issues. Not considering overall monitor administration (ex: actions, advanced options, schedule, etc.) is there an technical advantage or reason in either creating a single log file monitor containing multiple match filter OR multiple log file monitors with single match filters? |
|
It would be more efficient to have a single monitor. The reason is a monitor has to read chunks of the file to figure out if the file was flushed and started getting overwritten from the beginning, and it has to do a database query or two for that. Then it needs to read in the new parts of the file to check. All of the file I/O would be multiplied by 12 in this case. Running the actual filters on the content is comparatively light so it's no problem to do 12 of them in a row on the same chunk of text. Having said that, even having 12 monitors won't cause a whole lot of work though. |
