# Filebeat not steaming the sar logs **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 2, 2016, 8:43pm UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305 "2016-03-02T20:43:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vgupta](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@vgupta](https://discuss.elastic.co/u/vgupta)\ **Post date:** [March 2, 2016, 8:43pm UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305/1 "2016-03-02T20:43:01Z")
I am getting following error when streaming the system sar log file 2016-03-01T00:24:08Z INFO Read line error: file inactive 2016-03-01T23:53:02Z INFO Harvester started for file: /var/log/sa/sar01 2016-03-02T00:23:07Z INFO Read line error: file inactive The SAR files get overwritten after 30 days, so SAR01 get overwritten on Feb01, March01 Our config file has ```auto ignore_older: 30m scan_frequency: 60s spool_size: 1024 idle_timeout: 5s ``` This is affecting our ability to collect sar logs, please suggest what config changes that we need to do or if the scenario is not supported. thanks Vinay * * * ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [March 2, 2016, 11:05pm UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305/2 "2016-03-02T23:05:17Z")
Why set `ignore_older: 30m`? 1. Is the 'active' SAR file being shipped ok by filebeat? 2. If so, why ship file again after being rotated? 3. You want to index historical data only, or will this be a general problem in production after historical data have been indexed? 4. How does logrotation work? Sounds like files are just renamed. filebeat detects file has been moved (but still same file) and will not attempt to resend the file. ---
**Author:** ![vgupta](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@vgupta](https://discuss.elastic.co/u/vgupta)\ **Post date:** [March 3, 2016, 1:41am UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305/3 "2016-03-03T01:41:56Z")
Thanks Steffens 1. The sar files are in /var/log/sa/sar\<1-30\> A particular sar file get overwritten once every month. When I first started the filebeat, the sar files were shipped accurately but on March 1st, sar01 got overwritten and that didn't got shipped. So this a general problem in production has nothing to do with the historical data. ---
**Author:** ![Sumantha\_Kannantha](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@Sumantha\_Kannantha](https://discuss.elastic.co/u/Sumantha_Kannantha)\ **Post date:** [March 11, 2016, 10:03am UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305/4 "2016-03-11T10:03:52Z")
We are also facing same problem * * * ``` ignore_older: 12h document_type: log4j scan_frequency: 0s ``` * * * /usr/bin/filebeat[27676]: log.go:157: Read line error: file inactive Any workaround for this issue? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 11, 2016, 2:45pm UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305/5 "2016-03-11T14:45:09Z")
Can you provide some more details? Two notes: - The indentation in your config looks off - I highly discourage using scan\_frequency: 0s as this will lead to high cpu and disk usage. Any reason you set it so low? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/filebeat-not-steaming-the-sar-logs/43305/6 "2017-07-05T21:54:40Z")