-
Problem report
-
Resolution: Unresolved
-
Trivial
-
None
-
4.0.33rc1
-
None
-
GNU/Linux
When logrt[] analyzes a log file which ends with a large record (over 256 kB) without newline at the end then the record is reported to server (if it matches the regexp).
If there is a newer log file then logrt[] proceeds with analyzing it and skips the first record (this is incorrect).
Steps to reproduce:
1) Create the older log file with a large record without newline at the end, e,g.
$ perl -le 'print "a"x300000' | dd bs=1 count=299999 > test.log299999
2) Create the newer log file, e,g.
$ echo test1 > test.log $ echo test2 >> test.log
Now there are 2 test files, with timestamps, e.g.
$ ls -ltr test* -rw-r--r-- 1 zabbix zabbix 299999 jul 8 17:55 test.log299999 -rw-r--r-- 1 zabbix zabbix 12 jul 8 17:56 test.log
Create a new test item like
logrt[/home/zabbix/^test.log]
Observe in "Monitoring->Latest data" that record "test1" is missing:
2021-07-08 17:58:47 1625756327 "test2" 2021-07-08 17:58:47 1625756327 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa .....
The record should be:
- large,
- the last record in the file,
- without newline at the end
for this error to happen.