You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If the position file is opened by another process, such as an antivirus utility, then the temporary files generated during that time are abandoned and continue to be produced and never cleaned up. Using read all channels this has produced hundreds of thousands of temporary position files that are abandoned.
Presumably this is leading to duplicate logs being read and forwarded to the endpoint due to the index not being incremented properly, but have not verifiled this.
To Reproduce
The simplest way to reproduce this is to have Notepad lock the file by running from a command prompt:
Notepad >> winevt.json
As long as Fluentd is running the temp files will continue to be orphaned until Notepad is closed. Even after Notepad is closed Fluentd does not clean up the files.
Expected behavior
Expected behavior is for Fluentd to retry updating the pos file if it is locked by an AV process, and delete abandoned POS temp files once successful.
Describe the bug
If the position file is opened by another process, such as an antivirus utility, then the temporary files generated during that time are abandoned and continue to be produced and never cleaned up. Using read all channels this has produced hundreds of thousands of temporary position files that are abandoned.
Presumably this is leading to duplicate logs being read and forwarded to the endpoint due to the index not being incremented properly, but have not verifiled this.
To Reproduce
The simplest way to reproduce this is to have Notepad lock the file by running from a command prompt:
Notepad >> winevt.json
As long as Fluentd is running the temp files will continue to be orphaned until Notepad is closed. Even after Notepad is closed Fluentd does not clean up the files.
Expected behavior
Expected behavior is for Fluentd to retry updating the pos file if it is locked by an AV process, and delete abandoned POS temp files once successful.
Your Environment
Your Configuration
Your Error Log
Additional context
Any buffers continue to send until complete.
The text was updated successfully, but these errors were encountered: