Skip to content

in_tail: fails to detect rotation of ignored file #11406

@uskf

Description

@uskf

Bug Report

Describe the bug
in_tail plugin fails to detect rotation of ignored file

To Reproduce

  • Steps to reproduce the problem:
  1. set variable
# IGNORE_OLDER=60
# REFRESH_INTERVAL=30
  1. create a file for input
# echo 001 >  /tmp/input.log; \
  echo 002 >> /tmp/input.log
  1. wait for file to be ignored
# sleep $(( $IGNORE_OLDER + $REFRESH_INTERVAL + 1 ))
  1. rename (rotation)
# mv /tmp/input.log /tmp/input.log.1
  1. create a new file for input
# echo 003 >> /tmp/input.log; \
  echo 004 >> /tmp/input.log; \
  echo 005 >> /tmp/input.log

Expected behavior
expected output (/tmp/output.log)

{"log":"001"}
{"log":"002"}
{"log":"003"}
{"log":"004"}
{"log":"005"}

Actual results

actual output (/tmp/output.log)

{"log":"001"}
{"log":"002"}
{"log":"005"}

Your Environment

  • Version used: fluent-bit-4.2.2-1.x86_64
  • Configuration:
# /etc/fluent-bit/fluent-bit.conf
[SERVICE]
    Flush                     1
    Daemon                    off
    Log_Level                 debug
    Parsers_file              parsers.conf

[INPUT]
    Name                      tail
    Path                      /tmp/input.log
    Read_From_Head            true
    read_newly_discovered_files_from_head true
    Parser                    not_empty_line
    db                        /tmp/input-tail.db
    Ignore_Older              60
    ignore_active_older_files true
    refresh_interval          30

[OUTPUT]
    Name                      file
    File                      /tmp/output.log
    Format                    plain
    Match                     *
# /etc/fluent-bit/parsers.conf
[PARSER]
    Name       not_empty_line
    Format     regex
    Regex      ^.+$
  • Environment name and version (e.g. Kubernetes? What version?): systemd 239 (239-82.el8_10.8)
  • Server type and version: VM
  • Operating System and version: Rocky Linux release 8.10 (Green Obsidian)
  • Filters and plugins:

Additional context

when a log rotation occurs after a file has been ignored due to ignore_older and ignore_active_older_files, fluent-bit fails to detect the rotation and the size value ​​of the previous file is carried over to the new file. Because of that, head of new file is skipped.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions