I have a large amount of existing data stored in files on a NAS (stored in hierarchical date-based directories, not that I think that matters). These directories are still being written to.
I have created a new syslog-ng file() source to process this data. However, when I start up the syslog-ng service, it starts processing the data from the beginning (going back several years). It will take far to long to process all that data, and it's useless anyway.
I want syslog-ng to only process new data that is added to the directory on the NAS. To set the pointer stored in syslog-ng.persist directly to the end of the files, as it were. Is this possible?