Commits
Andris Mednis authored 31da2d7abaaM
...G...... [ZBX-7098] improved handling of log file rotation/truncation for logrt[] and log[] items
Before this change:
- Only file modification time ('mtime') and size ('lastlogsize') were used to decide which log file
and from which position to analyze for pattern-matching lines. It worked if all log files had different
modification times, if a log file was not truncated and quickly grew larger than before.
If rotation resulted in multiple log files with the same 'mtime' or a single small log file was truncated
and written again with larger size then some log file data could be analyzed twice and some data could be
skipped without analyzing and reporting to Zabbix server.
After this change:
- In addition to 'mtime' and 'lastlogsize' Zabbix agent now internally uses also inode numbers (on UNIX/GNU/Linux)
and file indexes (on Microsoft Windows) and MD5 sums of the first 512-bytes for deciding whether
a log[] or logrt[] file checked during the previous check can be counted as the same file and can be checked
from 'lastlogsize' position, or it is a different file and should be analyzed from the start.
- On UNIX/GNU/Linux systems it is assumed that the file systems where log files are stored report inode numbers
which can be used to track files.
- On Microsoft Windows the Zabbix agent determines the file system type the log files reside on.
On NTFS file systems 64-bit file indexes are used to track log files.
On ReFS file systems (only from Microsft Windows Server 2012) 128-bit file IDs are used to track log file rotation.
On file systems where file indexes change (e.g. FAT32, exFAT) a fall-back algorithm is used to take
a sensible approach in uncertain conditions when log file rotation results in multiple log files with
the same 'mtime'.
- Inode numbers, file indexes and MD5 sums are internally collected by Zabbix agent. They are not transmitted to
Zabbix server and are lost when Zabbix agent is stopped. When Zabbix server is started again it receives only
'mtime' and 'lastlogsize' for logrt[] and 'lastlogsize' for log[] items from server (as before this change).Showing diff to50b974f3de0