I have a UF that is monitoring 5 rather large (200MB to 12GB) files and then sending via TCPOUT uncooked data to an rsyslog server. However, it appears that some of the events are getting split randomly. I suspect it's due to the AUTOLB function but I want to ask here before I resort to sending additional tens of GBs of data per hour to a single server.
Inputs on UF:
[batch:///output/file.txt]
move_policy = sinkhole
crcSalt =
_TCP_ROUTING = senddata
Outputs on UF:
[tcpout]
[tcpout:senddata]
server=1.1.1.1:515, 1.1.1.2:515, 1.1.1.3:515, 1.1.1.4:515
sendCookedData = false
disabled=false
To also add to this I have verified that the data is NOT cut in the raw txt file before the UF picks it up. It is about 5-19 cuts per file (so about losing 5-19 events per hour per file) which makes me suspect that AutoLB for TCPOUT is load balancing in the middle of an event.
All of these events are single-line JSON files, the data is cut randomly throughout the events, sometimes it's 5 characters in, in the middle of a JSON object or it is even sometimes the very last "}" in the JSON and no other characters.