responses
Hi,
I'm using nxlog ce latest version with centos 7 with latest patches to read files from a directory that is a cifs mount to a windows server. Logs are in w3c format.
However from times to times, I'm getting the information in nxlog log file "INFO input file '' was truncated, restarting from the beginning", but the file isn't truncated.
Using strace with options -tfp (since debug option of nxlog doesn't give me much information) i get this:
pid 7675] 12:52:58 close(16 [pid 7676] 12:52:58 <... stat resumed> {st_mode=S_IFREG|0400, st_size=144080774, ...}) = 0 [pid 7676] 12:52:58 stat("", [pid 7675] 12:52:58 <... close resumed> ) = 0 [pid 7676] 12:52:58 <... stat resumed> {st_mode=S_IFREG|0400, st_size=54218426, ...}) = 0 [pid 7675] 12:52:58 stat("", [pid 7676] 12:52:58 stat("", [pid 7675] 12:52:58 <... stat resumed> {st_mode=S_IFREG|0400, st_size=277116066, ...}) = 0 [pid 7675] 12:52:58 fstat(26, {st_mode=S_IFREG|0400, st_size=277116066, ...}) = 0 [pid 7676] 12:52:58 <... stat resumed> {st_mode=S_IFREG|0400, st_size=141529135, ...}) = 0 [pid 7676] 12:52:58 stat("", {st_mode=S_IFREG|0400, st_size=148346198, ...}) = 0
My nxlog configuration is this:
User nxlog Group nxlog
LogFile /var/log/nxlog/nxlog.log LogLevel INFO
define DIR
Module xm_syslog
Module im_file File '%DIR%/_*_.w3c' SavePos TRUE ReadFromLast TRUE Recursive TRUE RenameCheck TRUE CloseWhenIdle TRUE PollInterval 5 DirCheckInterval 10 ActiveFiles 4
<Exec>
to_syslog_bsd();
</Exec>
Module om_tcp Host Port 514
Path in1 => out_syslog-ng
Can you understand why nxlog says that file is truncated when it's not?
Comments (2)
Hi,
Thank you for your reply, however if that was the problem, shouldn't it happen all the time?
In relation to the inode number, I already do a workaround with noserverino and the file modification is always the same because of the lazy write windows behavior and regarding the file size it continuously grow.
For the record, my mount options are those for cifs.
_netdev,ro,soft,noserverino,nouser_xattr,cache=none,rsize=65536,vers=2.1,file_mode=0400,dir_mode=0500,port=445,sec=ntlmsspi,credentials=<credentials file>,uid=nxlog,gid=nxlog 0 0
im_file checks this status every 2 seconds only so it's probably timing related depending on how fast your mount updates the file information.