Get data from Login Audit.csv in distributed environment?

Question

lHi, 
 Is there any way to achieve below scenario other than log streaming form Appain? 
 Currently our PROD environment has 3 servers and based on the load users are navigated to different Servers. 
 We would like to get login-audit.csv file from all the 3 servers. Currently with readcsvlog function we are able to get data only from the current server where the function is ran. 
 
 Any suggestions are appreciated. 
 Thanks.

Mike Schmitt · Answer

I have a process that does uses the "read log" plug-in function. I found in our distribued prod environment that it had approximately a random chance of pulling the logs from one of the 3 distributed log directories if I ran several in a row. 
 So I made a separate process, with a "start process" smart service node calling this subprocess (and passing its data back to the parent). I then set this node to run on MNI 10 times, "run one at a time" (important). All the data gets passed back to the parent process and then deduplicated - and I have proven that this will pull from all 3 login-audit.csv files, when run a sufficient number of times. Even then, this information should be considered "approximate". 
 Also keep in mind that if the environment has fairly few logins for the current day, the login-audit.csv file in some of the distributed directories might still be the data for a previous day. So whatever you implement will need to account for this possibility as well.

Mike Schmitt · Answer

In general you just include the date in the filename like you've done above. But for an environment with distributed logs, your engine 1 might have a file matching yesterday's date, while engine 2 still has yesterday's logins stored in the general "login-audit.csv". 
 So I set up something in my subprocess with one extra level of complexity - I have it query the named log file for yesterday, then i check if the results were blank, and if so, i query the general login audit file. 
 In my case, after deduplication and all, I write these to my own database table. But because of the possibility for duplicated entries to be written, I then take the further step of querying the existing table for matching entries and weeding out ones that have already been written (i.e. entries with the same username and login timestamp).