...
| Warning |
|---|
The purpose of the file destination is to store the copy of each event that is successfully sent to at least one network destination. If If there is no network destination or all network destinations are down then no event destination and at least one file destination, Snare will keep writing new events to the file destination but will not show these events in Latest Events page. If there are more than one network destinations and one file destination, Snare will write a event to the file destination if it can first successfully send event to at least one of the network destinations. If none of the network destinations is available, Snare will add events to a memory cache and will write those events to the file destination as well. Once the memory cache reaches its capacity, no additional events will be written to the file destination. If If there is a need to store the events locally only in a file destination then a dummy UDP network destination must be added. |
...