[ZBX-12250] Item logrt skips created new log file after agent restarted Created: 2017 Jun 01 Updated: 2018 Jun 11 Resolved: 2018 Jun 08 |
|
Status: | Closed |
Project: | ZABBIX BUGS AND ISSUES |
Component/s: | Agent (G) |
Affects Version/s: | 2.2.17, 4.0.0alpha7 |
Fix Version/s: | 3.0.19rc1, 3.4.11rc1, 4.0.0alpha8, 4.0 (plan) |
Type: | Incident report | Priority: | Minor |
Reporter: | Junichi Karikomi | Assignee: | Andris Mednis |
Resolution: | Fixed | Votes: | 0 |
Labels: | logmonitoring, logrt | ||
Remaining Estimate: | Not Specified | ||
Time Spent: | Not Specified | ||
Original Estimate: | Not Specified |
Team: | Team A |
Sprint: | Sprint 32, Sprint 33, Sprint 34, Sprint 35 |
Story Points: | 4 |
Description |
This problem is observable in following situation # echo abcd > /tmp/logtest/f1 2. Create item "logrt[/tmp/logtest/f1]" and begin monitoring, # service zabbix-agent stop 4. Remove the log file. # rm /tmp/logtest/f1 5. Restart the agent. # service zabbix-agent start 6. Create new log file. # echo ABCD > /tmp/logtest/f1 7. Append string to the log file. # echo XYZ >> /tmp/logtest/f1 In step 5, the agent process knows no files exist. |
Comments |
Comment by Andris Mednis [ 2018 May 11 ] |
Succesfully reproduced in 2.2 and trunk, so most likely all versions are affected.
What could the agent have done better ? Agent could notice that after start it received mtime:1526025056" from server, but the new log file has a different mtime:1526025466 - that is the sign things have changed and the log file should be analyzed from the start. What do you think ? Would it be a good solution (for both small and large log files) - to trigger analyze from start in this situation by 'mtime' change ? If size is smaller, the agent analyzes from start. If size is larger,, the agent analyzes from lastlogsize (e.g.5). When size is equal, the problem arises as you described. |
Comment by Junichi Karikomi [ 2018 May 14 ] |
I think follows. When the file not exist at the agent restarted, and the agent find a file after it. The file should be new file. The agent should analyzes from start regardless of the file size.
The file may be recreated between stoped the agent and restarted, the agent cannot judge that the file has been recretaed or not. In this case, the agent works same as currently.
|
Comment by Andris Mednis [ 2018 May 16 ] |
So, it was proposed to modify logrt[] that if there are no files to analyze, then keep 'mtime' as is, but reset 'lastlogsize' to 0. |
Comment by Junichi Karikomi [ 2018 May 17 ] |
I'm warrying to work the skip option incorrectly when the log file recareted.
|
Comment by Andris Mednis [ 2018 May 25 ] |
As of |
Comment by Andris Mednis [ 2018 May 28 ] |
I propose to modify agent as follows:
|
Comment by Andris Mednis [ 2018 May 30 ] |
Fixed in development branch svn://svn.zabbix.com/branches/dev/ZBX-12250-30 for Zabbix 3.0. |
Comment by Andris Mednis [ 2018 Jun 06 ] |
Available in versions:
|
Comment by Andris Mednis [ 2018 Jun 06 ] |
Documented in: sasha Thanks! CLOSED |