'tail -f' functionality for file reading in input framework

Description

With the current input framework, file data -> event translation requires that the entire data file be read at bro start time. This can be prohibitive when the file sizes become large ( > 1GB ).

It would be great to see a file open option that would start reading at the end of the file.

Environment

None

Assignee

Robin Sommer

Reporter

scampbell

Labels

None

External issue ID

985

Components

Fix versions

Affects versions

Priority

Low
Configure