Environment
Sentinel ALL
Situation
What is the difference between file all and file new connection types?
Resolution
File New Connection Type
The File New connection type is used to read only security event data that isadded to a file after the script has started. File New opens this file and reads fromthe end of the file. You must specify in the Rx/Tx Value box the path to the logfile.
For more information
about configuring agent with this connection type, see theagent
documentation (such as agent Solaris Syslog) located in%workbench_home%\elements\\docs
File All Connection Type
The File All connection type is used to read all the security event data in a file. If you select File New or File All, you can enter either inputfile or outputfile for theRx/Tx Value. The format is as follows:
[inputfile, outputfile |inputfile |outputfile]
If you select File New or File All and the file shrinks, the file is read from thebeginning.