Filebeat - 7.10.2 - Flooding Syslog with CIFS Errors

Elastic Stack Beats
1

Previously I was running Filebeat 7.5 on Ubuntu 18.04. I have installed Filebeat 7.10.2 on Ubuntu 20, and now my syslog is flooded with this message while filebeat is running:

CIFS VFS: Close unmatched open

The configurations are the same, and the way I mount the share in /etc/fstab is Identical. I have 15-20 filebeat yml files in /etc/filebeat/inputs.d using a blob pattern.. like /nfsshare/**/_sharetype/LOGFILE.log

Everything appears to be working, not sure if this is an issue I need to worry about or not.

2

Hi!

Not sure where this one comes from but from a quick search I see that it should be a message from kernel that has to do with volume mounts, filesharing etc.

Do you see this specific error only when running Filebeat or if you stop Filebeat the error will go away?

C.

3

The messages only occur while Filebeat is running. Once I stop Filebeat they stop right away.

4

All right.

Does Filebeat run natively as process on your system or its containerised? Do you have any special mounts or shared filesystems that Filebeat access?

5

It is running as a system service in a pretty bare OS. (Not containerized). It is scanning files from a network share that is mounted as a cifs share in /etc/fstab.

Filebeat 7.10.2 on Ubuntu 18.04 does not appear to have this issue.

6

Well, it should be related to the cifs share then, maybe because of a library change or sth. If you don't see Filebeat failing then I think you can ignore that error. Please raise an issue if you see Filebeat failing or losing events. Thanks!

7

Tried the older version of CIFS same issue, kernel upgrade was done and the error went away.

1 Like
8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.