Comments (2)
You're right! I'll examine this.
from check_logfiles.
We had the same problem and made the same modification as betagan, but it does not work for type=rotating::uniform.
The debug logs are as follows:
Thu Sep 19 07:07:30 2019: ==================== /var/log/backup/dummy ==================
Thu Sep 19 07:07:30 2019: the newest uniform logfile i found is /var/log/backup/daily.log-20190919
Thu Sep 19 07:07:30 2019: rewrote uniform seekfile to /var/tmp/check_logfiles/check_logfiles._var_log_backup_uniformlogfile.daily.log
Thu Sep 19 07:07:30 2019: found seekfile /var/tmp/check_logfiles/check_logfiles._var_log_backup_uniformlogfile.daily.log
Thu Sep 19 07:07:30 2019: LS lastlogfile = /var/log/backup/daily.log-20190919
Thu Sep 19 07:07:30 2019: LS lastoffset = 79388 / lasttime = 1568743901 (Wed Sep 18 03:11:41 2019) / inode = 66305:12993010
Thu Sep 19 07:07:30 2019: found private state $VAR1 = {
'runcount' => 5,
'lastruntime' => 1568671650,
'logfile' => '/var/log/backup/daily.log-20190918'
};
Thu Sep 19 07:07:30 2019: this is not the same logfile 66305:12993010 != 66305:13082671
Thu Sep 19 07:07:30 2019: Log offset: 79388
Thu Sep 19 07:07:30 2019: looking for rotated files in /var/log/backup with pattern daily\.log-\d{8}
Thu Sep 19 07:07:30 2019: archive /var/log/backup/daily.log-20190914 matches (modified Sat Sep 14 03:39:31 2019 / accessed Wed Sep 18 00:03:04 2019 / inode 12606024 / inode changed Sat Sep 14 03:39:31 2019)
Thu Sep 19 07:07:30 2019: archive /var/log/backup/daily.log-20190915 matches (modified Sun Sep 15 03:10:46 2019 / accessed Wed Sep 18 00:03:04 2019 / inode 13079971 / inode changed Sun Sep 15 03:10:46 2019)
Thu Sep 19 07:07:30 2019: archive /var/log/backup/daily.log-20190916 matches (modified Mon Sep 16 03:18:51 2019 / accessed Thu Sep 19 00:02:54 2019 / inode 13082655 / inode changed Mon Sep 16 03:18:51 2019)
Thu Sep 19 07:07:30 2019: archive /var/log/backup/daily.log-20190917 matches (modified Tue Sep 17 03:27:36 2019 / accessed Thu Sep 19 00:02:54 2019 / inode 13082667 / inode changed Tue Sep 17 03:27:36 2019)
Thu Sep 19 07:07:30 2019: archive /var/log/backup/daily.log-20190918 matches (modified Wed Sep 18 03:11:41 2019 / accessed Wed Sep 18 07:07:31 2019 / inode 12993010 / inode changed Wed Sep 18 03:11:41 2019)
Thu Sep 19 07:07:30 2019: archive /var/log/backup/daily.log-20190919 matches (modified Thu Sep 19 03:16:46 2019 / accessed Thu Sep 19 03:15:09 2019 / inode 13082671 / inode changed Thu Sep 19 03:16:46 2019)
Thu Sep 19 07:07:30 2019: archive /var/log/backup/daily.log-20190919 was modified after Wed Sep 18 03:11:41 2019
Thu Sep 19 07:07:30 2019: opened logfile /var/log/backup/daily.log-20190919
Thu Sep 19 07:07:30 2019: logfile /var/log/backup/daily.log-20190919 (modified Thu Sep 19 03:16:46 2019 / accessed Thu Sep 19 03:15:09 2019 / inode 13082671 / inode changed Thu Sep 19 03:16:46 2019)
Thu Sep 19 07:07:30 2019: first relevant files: daily.log-20190919, daily.log-20190919
Thu Sep 19 07:07:30 2019: /var/log/backup/daily.log-20190919 has fingerprint 66305:13082671:81593
Thu Sep 19 07:07:30 2019: /var/log/backup/daily.log-20190919 has fingerprint 66305:13082671:81593
Thu Sep 19 07:07:30 2019: skipping /var/log/backup/daily.log-20190919 (identical to /var/log/backup/daily.log-20190919)
Thu Sep 19 07:07:30 2019: relevant files: daily.log-20190919
Thu Sep 19 07:07:30 2019: moving to position 79388 in /var/log/backup/daily.log-20190919
Thu Sep 19 07:07:30 2019: stopped reading at position 81593
Thu Sep 19 07:07:30 2019: keeping position 81593 and time 1568830606 (Thu Sep 19 03:16:46 2019) for inode 66305:13082671 in mind
Because daily.log-20190918 is not included in @rotatedfiles, daily.log-20190919 is read from the last offset of daily.log-20190918, not from the beginning.
This can be avoided by including files which has
(1) mtime greater than previous logtime, or
(2) mtime equals previous logtime AND size equals previous offset,
i.e.
if ((stat $archive)[9] > $self->{laststate}->{logtime} ||
(stat $archive)[9] == $self->{laststate}->{logtime} &&
$self->getfilesize($archive) == $self->{laststate}->{logoffset}) {
The above change does not work if more than one rotation occurs within one second, but it is a vary rare case and can be ignored, I think.
from check_logfiles.
Related Issues (20)
- logfilemissing=critical only working in commandline not in config
- configure file is missing HOT 3
- second critical pattern doesn't worked HOT 7
- CL_CAPTURE_GROUPx not present in $ENV HOT 3
- How to make check_logfiles not delete an alert? HOT 1
- check_logfiles on /var/log/message resulting in frequent socket timeouts HOT 1
- Feature request: Indicate the user who should execute the search, by parameters
- specific options for one search pattern
- thresholdexpiry HOT 1
- seekfiles ignored after server reboot HOT 6
- "Buy me a coffee" link does not work
- Multiple line output
- Critical pattern found but plugin exits OK HOT 1
- nosavethreshold from cmd line
- Scripts not working as expected? HOT 2
- "winwarncrit" option causes Windows eventlog messages to be prefixed with "EE_(EE|WW)_TT"
- Please add newer tags to your repository HOT 1
- Some tests in test suite do fail HOT 2
- Test suite tests not always reproducible
- Docker example
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from check_logfiles.