Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-1054

zabbix agent cannot treat 0 byte log file properly and doesn't reset 'lastlogsize' to 0. As a result, some data will be lost.

    Details

    • Type: Incident report
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 1.6
    • Fix Version/s: None
    • Component/s: Agent (G)
    • Labels:
      None
    • Environment:
      LInux and Windows (maybe also other environments)
      Zabbix Agent 1.6.6 from ZABBIX SIA

      Description

      zabbix agent cannot treat 0 byte log file properly and doesn't reset 'lastlogsize' to 0.
      As a result, some datas will be lost.

      Usually, when zabbix monitor a log file after logrotated, the log filesize is smaller than that last zabbix monitored and zabbix reset 'lastlogsize' to the new filesize.
      But, if the log filesize is 0 byte, zabbix doesn't reset 'lastlogsize' to 0.
      So, if monitoring a log file which generates few datas, some datas will be lost.
      I checked this problem occurs on Windows and Linux. Maybe it also occurs on other environments.

      detail:
      At src/zabbix_agent/logfiles.c:90, if the log filesize is 0 byte, following fgets returns NULL.
      > if (NULL == fgets(*value, MAX_BUF_LEN, f))
      >

      { > /* EOF */ > zbx_free(*value); > }

      So, following 'value' will be NULL and go to break at src/zabbix_agent/active.c:672.
      Zabbix dosen't send 'lastlogsize'.
      > if (!value) /* EOF */
      > break;

      How to reproduce:
      (step 1)
      Assume the target log file is /var/log/test.log
      Make log file monitoring item as following.

      Type: "ZABBIX agent (active)"
      Key: "log[/var/log/test.log]"
      Type of information: "Log"

      (step 2)
      At first, a log file has following data.

      1. cat /var/log/test.log
        foo

      (step 3)
      Zabbix check the log file. Then zabbix send "foo" as a log and "4" as 'lastlogsize'.
      The 'lastlogsize' data is in 'lastlogsize' column in 'items' table in 'zabbix' database.

      mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
      -------------

      lastlogsize

      -------------

      4

      -------------

      (step 4)
      Logrotated.
      The log file exists. And it's 0 byte.

      1. cat /var/log/test.log

      (step 5)
      Zabbix check the log file. But, it sends nothing.
      'lastlogsize' is still 4.
      The data is in 'lastlogsize' column in 'items' table in 'zabbix' database.

      mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
      -------------

      lastlogsize

      -------------

      4

      -------------

      (step 6)
      The log file is added a log. Now, the log file has following data.

      1. cat /var/log/test.log
        barbarbar

      (step 7)
      Zabbix check the log file. Then zabbix detect the log filesize is 10.
      Zabbix shoud send "barbarbar" as a log and set 10 as 'lastlogsize'.
      But zabbix send "arbar" as a log, because last 'lastlogsize' was 4.

      mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
      -------------

      lastlogsize

      -------------

      10

      -------------

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              tsuzuki Takanori Suzuki
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: