Please consider to add an option to support the monitoring of pruned logs.
Without such option it can be hard to monitor for example log files from IBM TSM Backup-Archive Clients.
These clients allow an option to prune log entries older than a specified number of days, what may lead to a lower log file size - thus by Zabbix seen as new file/data.
Details about the mentioned "schedlogretention" option may be found here:
One idea to achieve this in an efficient way could be to use binary search for evaluating the original end of log file:
The search "key" could be 'Local time'. Thus the following preconditions should be met:
- Item has "Log time format" set
- Last 'Local time' value is known.
- Log size is lower than lastlogsize but greater than 0.
For cases where same 'Local time' may be evaluated between check intervals one has to decide between:
- miss entries (beginning after the last occurrence of a key hit)
- duplicate entries (beginning after the first occurrence of a key hit)
- undefined/both (beginning after first key hit)
- and maybe others...