Problem
A permanently-failing poll in macosunifiedloggingreceiver is retried forever while the collector reports itself healthy.
readLogs (receiver/macosunifiedloggingreceiver/receiver.go) logs the error and backs off to max_poll_interval, then keeps retrying. Nothing else observes the failure.
Some failures are deterministic and will never succeed:
- A malformed predicate.
log exits 64 (EX_USAGE), e.g. log: Bad predicate (Unable to parse the format string "subsystem =="). The predicate is not validated in-process, by design — log owns its grammar.
- A predicate referring to a field
log rejects.
For these, the receiver emits nothing indefinitely and the only signal is a repeating log line. This matters because the predicate is fleet-pushed: a bad value can be deployed to many hosts at once.
Recommendation
Report component status instead of only logging:
- Call
componentstatus.ReportStatus with a permanent error when a poll fails with a deterministic cause (log exit 64), so a health-check extension surfaces the receiver as unhealthy to the fleet manager.
- Keep retrying transient failures with the existing backoff and
StatusRecoverableError.
Do not fail Start instead: that aborts the whole collector, taking down unrelated pipelines on the host.
Requires confirming the collector build wires componentstatus and a health-check extension.
Notes
Deliberately out of scope: distinguishing every log exit code. Exit 64 is sufficient to separate "config is wrong" from "read failed".
Problem
A permanently-failing poll in
macosunifiedloggingreceiveris retried forever while the collector reports itself healthy.readLogs(receiver/macosunifiedloggingreceiver/receiver.go) logs the error and backs off tomax_poll_interval, then keeps retrying. Nothing else observes the failure.Some failures are deterministic and will never succeed:
logexits 64 (EX_USAGE), e.g.log: Bad predicate (Unable to parse the format string "subsystem =="). The predicate is not validated in-process, by design —logowns its grammar.logrejects.For these, the receiver emits nothing indefinitely and the only signal is a repeating log line. This matters because the predicate is fleet-pushed: a bad value can be deployed to many hosts at once.
Recommendation
Report component status instead of only logging:
componentstatus.ReportStatuswith a permanent error when a poll fails with a deterministic cause (logexit 64), so a health-check extension surfaces the receiver as unhealthy to the fleet manager.StatusRecoverableError.Do not fail
Startinstead: that aborts the whole collector, taking down unrelated pipelines on the host.Requires confirming the collector build wires
componentstatusand a health-check extension.Notes
Deliberately out of scope: distinguishing every
logexit code. Exit 64 is sufficient to separate "config is wrong" from "read failed".