INFO File was truncated. Begin reading file from offset 0:

Elastic Stack Beats
1

Seeing a disproportionate number of these messages " INFO File was truncated. Begin reading file from offset 0:" in /var/log/filebeats . Curiously complete files are being processed needlessly again.

Log ingestion is happening on a netapp cifs share which is mounted on a Linux server.

Is it possible I could be seeing an inode reuse issue on the share, I know it can't be cache related as this has been turned off on the linux host and the netap device.

Can anyone shed any light and what effect if any the close_* config options might have on this issue?

2

It sounds a lot like a inode reuse issue. Best look into the clean_* options which should help you here: https://www.elastic.co/guide/en/beats/filebeat/6.0/configuration-filebeat-options.html#clean-removed (only available in newer versions of FB).

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.