Windows file reader file locking/rotation issue about collector HOT 10 OPEN

Thank you for the report. We will try to reproduce and fix it.

from collector.

We may have a similar issue. We have a service that logs to a file that is rotated at midnight. The Windows 0.4.1 collector maintains an open handle on the file, and at midnight when the old log is renamed with that day's date, the handle stays open to the now old file, and doesn't re-open a new handle to the new log file.

The only "fix" is to restart the graylog collector service so it picks up the new files/opens a new handle on those. I thought I saw something in a release note about the possibility of missing a file rename operation like that, but we're definitely seeing this issue.

Java 1.8.0_60, Graylog Collector for Windows 0.4.1, Windows Server 2012 R2.

Relevant config entry:
offline-task-trace {
type = "file"
path-glob-root = "C:\OfflineTools"
path-glob-pattern = "**\trace.log"
content-splitter = "PATTERN"
content-splitter-pattern = "(ERROR|WARN|INFO)\s\d{1,4} \d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3}\s"
}

The logging is from Log4Net tied into the app with this rotation method:

We're new to Graylog and it's going well in our testing so far except for this pretty big sticking point.

from collector.

Same is happening in my scenario. RedHat/AIX mostly.

Application is unable to correctly rotate logfiles and keeps logging to rotated logfile (quite a trouble honestly, because we archive rotated logs away and delete them periodically).

from collector.

Same problem here with W2003, Collector 0.4.1, JRE 1.7.0.
Agent and Edge Exchange Log which seems to rotate at midnight.

from collector.

Anyone find a solution ?

I have the same problem when logging dhcp log on my two DHCP server

from collector.

Same Problem here with graylog-collector 0.4.1 and Windows Server 2012 R2 with Exchange Server 2013.

from collector.

The problem remains in 0.4.2, the issue makes it difficult to collect log files from multiple applications if log file needs to be moved or re-created. I am running multiple FLEXlm daemons on Windows Server 2008R2 so have to stop graylog prior FLEXlm daemon/service restart.

from collector.

Same issue here on Windows 2008 R2. (Collector 0.4.2)

from collector.

Looks like this may not be fixed?

See the latest commit... graylog-collector is being deprecated in favor of: https://github.com/Graylog2/collector-sidecar

from collector.

@jt55401 Yes, we'll phase out the Graylog Collector. I'd recommend using nxlog or winlogbeat to collect Windows Eventlogs and nxlog or filebeat to collect files.

from collector.