[ZBX-1054] zabbix agent cannot treat 0 byte log file properly and doesn't reset 'lastlogsize' to 0. As a result, some data will be lost. Created: 2009 Sep 23  Updated: 2019 Apr 04  Resolved: 2009 Sep 29

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 1.6
Fix Version/s: None

Type: Incident report Priority: Major
Reporter: Takanori Suzuki Assignee: Unassigned
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

LInux and Windows (maybe also other environments)
Zabbix Agent 1.6.6 from ZABBIX SIA

Attachments: File zabbix-1.6.6-check_0bytelog.patch    

 Description   

zabbix agent cannot treat 0 byte log file properly and doesn't reset 'lastlogsize' to 0.
As a result, some datas will be lost.

Usually, when zabbix monitor a log file after logrotated, the log filesize is smaller than that last zabbix monitored and zabbix reset 'lastlogsize' to the new filesize.
But, if the log filesize is 0 byte, zabbix doesn't reset 'lastlogsize' to 0.
So, if monitoring a log file which generates few datas, some datas will be lost.
I checked this problem occurs on Windows and Linux. Maybe it also occurs on other environments.

detail:
At src/zabbix_agent/logfiles.c:90, if the log filesize is 0 byte, following fgets returns NULL.
> if (NULL == fgets(*value, MAX_BUF_LEN, f))
>

{ > /* EOF */ > zbx_free(*value); > }

So, following 'value' will be NULL and go to break at src/zabbix_agent/active.c:672.
Zabbix dosen't send 'lastlogsize'.
> if (!value) /* EOF */
> break;

How to reproduce:
(step 1)
Assume the target log file is /var/log/test.log
Make log file monitoring item as following.

Type: "ZABBIX agent (active)"
Key: "log[/var/log/test.log]"
Type of information: "Log"

(step 2)
At first, a log file has following data.

  1. cat /var/log/test.log
    foo

(step 3)
Zabbix check the log file. Then zabbix send "foo" as a log and "4" as 'lastlogsize'.
The 'lastlogsize' data is in 'lastlogsize' column in 'items' table in 'zabbix' database.

mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------

lastlogsize

-------------

4

-------------

(step 4)
Logrotated.
The log file exists. And it's 0 byte.

  1. cat /var/log/test.log

(step 5)
Zabbix check the log file. But, it sends nothing.
'lastlogsize' is still 4.
The data is in 'lastlogsize' column in 'items' table in 'zabbix' database.

mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------

lastlogsize

-------------

4

-------------

(step 6)
The log file is added a log. Now, the log file has following data.

  1. cat /var/log/test.log
    barbarbar

(step 7)
Zabbix check the log file. Then zabbix detect the log filesize is 10.
Zabbix shoud send "barbarbar" as a log and set 10 as 'lastlogsize'.
But zabbix send "arbar" as a log, because last 'lastlogsize' was 4.

mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------

lastlogsize

-------------

10

-------------

 Comments   
Comment by Takanori Suzuki [ 2009 Sep 23 ]

Solution:
Add a folloeing case.
If zabbix detect 0 byte log file in first time, set "" (only '\n') as 'value' to send data to set 'lastlogsize'.

I'll attatch a patch "zabbix-1.6.6-check_0bytelog.patch".
I checked it works good on my Linux.

After patching:
(step 1)
Assume the target log file is /var/log/test.log
Make log file monitoring item as following.

Type: "ZABBIX agent (active)"
Key: "log[/var/log/test.log]"
Type of information: "Log"

(step 2)
At first, a log file has following data.

  1. cat /var/log/test.log
    foo

(step 3)
Zabbix check the log file. Then zabbix send "foo" as a log and "4" as 'lastlogsize'.
The 'lastlogsize' data is in 'lastlogsize' column in 'items' table in 'zabbix' database.

mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------

lastlogsize

-------------

4

-------------

(step 4)
Logrotated.
The log file exists. And it's 0 byte.

  1. cat /var/log/test.log

(step 5)
Zabbix check the log file. Then zabbix send ""(only '\0') as a log and "0" as 'lastlogsize'.
Now, 'lastlogsize' is "0".
The data is in 'lastlogsize' column in 'items' table in 'zabbix' database.

mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------

lastlogsize

-------------

0

-------------

(step 6)
The log file is added a log. Now, the log file has following data.

  1. cat /var/log/test.log
    barbarbar

(step 7)
Zabbix check the log file. Then zabbix detect the log filesize is 10.
Zabbix sends "barbarbar" as a log and set 10 as 'lastlogsize'.

mysql> select lastlogsize from items where key_='log[/var/log/test.log]';
-------------

lastlogsize

-------------

10

-------------

Comment by richlv [ 2009 Sep 28 ]

confirming in trunk, rev 7973

Comment by richlv [ 2009 Sep 29 ]

confirming the fix in trunk, rev 7985

Comment by Takanori Suzuki [ 2009 Sep 30 ]

Hey richlv, I just saw svn repository.
But the fix was added at rev 7989.

richlv, how did you checked it with rev 7985?

And, Though I know my patch was not good at sending empty data('\0'), I'd like to know why Dmitry made fix to become lastlogsize empty only on the agent side.
As far as it works good and if it is your policy, it is acceptable for me.
But, I just want to know why.

Comment by richlv [ 2009 Sep 30 ]

sorry about that - some copy/paste error, actual testing was performed with revision 7994

Generated at Fri Apr 26 01:32:18 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.