-
Incident report
-
Resolution: Fixed
-
Major
-
None
-
1.6
-
None
-
LInux and Windows (maybe also other environments)
Zabbix Agent 1.6.6 from ZABBIX SIA
zabbix agent cannot treat 0 byte log file properly and doesn't reset 'lastlogsize' to 0.
As a result, some datas will be lost.
Usually, when zabbix monitor a log file after logrotated, the log filesize is smaller than that last zabbix monitored and zabbix reset 'lastlogsize' to the new filesize.
But, if the log filesize is 0 byte, zabbix doesn't reset 'lastlogsize' to 0.
So, if monitoring a log file which generates few datas, some datas will be lost.
I checked this problem occurs on Windows and Linux. Maybe it also occurs on other environments.
detail:
At src/zabbix_agent/logfiles.c:90, if the log filesize is 0 byte, following fgets returns NULL.
> if (NULL == fgets(*value, MAX_BUF_LEN, f))
>
So, following 'value' will be NULL and go to break at src/zabbix_agent/active.c:672.
Zabbix dosen't send 'lastlogsize'.
> if (!value) /* EOF */
> break;
How to reproduce:
(step 1)
Assume the target log file is /var/log/test.log
Make log file monitoring item as following.
Type: "ZABBIX agent (active)"
Key: "log[/var/log/test.log]"
Type of information: "Log"
(step 2)
At first, a log file has following data.
- cat /var/log/test.log
foo
(step 3)
Zabbix check the log file. Then zabbix send "foo" as a log and "4" as 'lastlogsize'.
The 'lastlogsize' data is in 'lastlogsize' column in 'items' table in 'zabbix' database.
mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------
lastlogsize |
-------------
4 |
-------------
(step 4)
Logrotated.
The log file exists. And it's 0 byte.
- cat /var/log/test.log
(step 5)
Zabbix check the log file. But, it sends nothing.
'lastlogsize' is still 4.
The data is in 'lastlogsize' column in 'items' table in 'zabbix' database.
mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------
lastlogsize |
-------------
4 |
-------------
(step 6)
The log file is added a log. Now, the log file has following data.
- cat /var/log/test.log
barbarbar
(step 7)
Zabbix check the log file. Then zabbix detect the log filesize is 10.
Zabbix shoud send "barbarbar" as a log and set 10 as 'lastlogsize'.
But zabbix send "arbar" as a log, because last 'lastlogsize' was 4.
mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------
lastlogsize |
-------------
10 |
-------------