[ZBXNEXT-4216] Modify logrt[] to process copy/truncate log file rotation (Z4) Created: 2017 Aug 25  Updated: 2024 Apr 10  Resolved: 2018 Jan 28

Status: Closed
Project: ZABBIX FEATURE REQUESTS
Component/s: None
Affects Version/s: 3.0.12
Fix Version/s: 4.0.0alpha3, 4.0 (plan)

Type: Change Request Priority: Trivial
Reporter: Rostislav Palivoda Assignee: Andris Mednis
Resolution: Fixed Votes: 0
Labels: logmonitoring
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: File patch_ZBXNEXT-4216_for_30.diff     File patch_ZBXNEXT-4216_for_30_20180122.diff.gz     File patch_ZBXNEXT-4216_for_30_r76973.diff.gz     File zabbix3.0.10_logrt_support_copytruncate.patch    
Team: Team A
Sprint: Sprint 15, Sprint 16, Sprint 18, Sprint 19, Sprint 20, Sprint 21, Sprint 22, Sprint 23, Sprint 24, Sprint 25, Sprint 26
Story Points: 30

 Description   

User wants to monitor a log file that is rotated copy-truncate.
Like copy current "app.log" to "app.log.1", and clear app.log.
A partner has implemented and tested a solution for Zabbix agent 3.0 (patch attached).

 Comments   
Comment by Kodai Terashima [ 2017 Aug 26 ]

Copy-truncate is a one optin for rsyslog or logrotate, users can choose "copytruncate" or "reload" behaviour for log rotation (reload is default).

According to man page, some log lines are lost while rotation with copytruncate mode.

Truncate the original log file to zero size in place after creating a copy, instead of moving the old log file and optionally creating a new one. It can be used when some program cannot be told to close its logfile and thus might continue writing (appending) to the previous log file forever. Note that there is a very small time slice between copying the file and truncating it, so some logging data might be lost. When this option is used, the create option will have no effect, as the old log file stays in place.

Comment by Andris Mednis [ 2017 Oct 31 ]

Thanks, Kodai, for comments!

Ok, then let's go with logrt[] and 8 parameters.

About MD5 - in other words, if MD5 sum of the first 512 bytes (ore less if files are shorter) are the same then it is an indicator that one of them is a copy.

Comment by Andris Mednis [ 2017 Nov 07 ]

Fixed in development branch svn://svn.zabbix.com/branches/dev/DEV-653-3 (for 3.0)

Comment by Andris Mednis [ 2017 Nov 27 ]

(1) No translation string changes.

Comment by Andris Mednis [ 2017 Dec 11 ]

Fixed in development branch svn://svn.zabbix.com/branches/dev/ZBXNEXT-4216-2 (for 4.0)

Comment by Vladislavs Sokurenko [ 2018 Jan 17 ]

Successfully tested

Comment by Andris Mednis [ 2018 Jan 18 ]

Available in versions:

  • pre-4.0.0alpha3 r76989
Comment by Andris Mednis [ 2018 Jan 18 ]

Documented in
https://www.zabbix.com/documentation/4.0/manual/config/items/itemtypes/zabbix_agent
https://www.zabbix.com/documentation/4.0/manual/config/items/itemtypes/log_items#notes_on_handling_copytruncate_log_file_rotation
https://www.zabbix.com/documentation/4.0/manual/introduction/whatsnew400#item_changesimprovements

martins-v Thanks, reviewed, with some minor rewording/grammar fixes in 'what's new' and the notes. CLOSED

Comment by Andris Mednis [ 2018 Jan 22 ]

Available in versions:

  • pre-4.0.0alpha3 r77051 (fixed Coverity warnings)
Generated at Fri Apr 26 00:27:49 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.