RSA Ace Server - duplicate data
I'm running Envision 3.5.1 and also have and ACE server running 6.0. I've been trying to find an acceptable way to get the logs over to the Envision box, without deleting the log on the ACE server. We've come accustomed to using the logfile on the ACE server and have reports etc using it. I've setup the SFTPAgent to push the logs over to Envision, but can't seem to avoid getting duplicate data.
ACE log Maintenance is setup with ARCHIVE ONLY, REPLACE FILE, HOURLY
The SFTPagent.conf is set to Not delete the log.
Problem is that every hour, RSA will copy the entire log to the Archive and in turn Envision will pull the file in each time. I don't want to use the ARCHIVE and DELETE option because then I'll have no logs at the ACE server for reporting and troubleshooting.
Most other systems I am able to maintain my logfiles locally as well has have Envision get their copy. Seems that I should be able to do the same with ACE.
# RSA ACE File Definitions
Is the logcsv.1 file you specified within the sftpagent.conf file the rollover archive file? Judging by the name of the file it might be a rollover archive file, which would explain why you are getting duplicates.
Is there another log file that is active which contains the most recent events? If there is, that active file should be the one you specify within the sftpagent.conf
Let me know if this helps.
The Log Maint settings in ACE are:
Log: Archive Only Archive File: Replace File
Archive Filename: logcsv
Cycle Through: 1
Select All Logs
Every 1 Hour
It looks like each Archive run always writes to the logcsv.1 file.
Looks like the option "Replace File" might be the culprit. If there is a way to specify not to replace the file, do so, then test it.
Let me know how it goes.