# Logstash 6.2.4 File input plugin spawning a lot of child .sincedb files **URL:** \ **Category:** Logstash\ **Created:** [May 31, 2018, 10:23am UTC](https://discuss.elastic.co/t/logstash-6-2-4-file-input-plugin-spawning-a-lot-of-child-sincedb-files/134018 "2018-05-31T10:23:50Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![ld\_pvl](https://avatars.discourse-cdn.com/v4/letter/l/cdc98d/32.png) [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Post date:** [May 31, 2018, 10:23am UTC](https://discuss.elastic.co/t/logstash-6-2-4-file-input-plugin-spawning-a-lot-of-child-sincedb-files/134018/1 "2018-05-31T10:23:50Z")
Hi Team, I've noticed this strange behaviour where let's say my original `.sincedb-foo` file was created by logstash under user A - i.e. the `.sincedb-foo` file is owned by user A. Now if I stop then start logstash up again but as user B, then even if `.sincedb-foo` is given global write permissions, logstash will start creating these "children" .sincedb files in this format: `.sincedb-foo.2064.18329.863496` for example. And there will be many many of these "children" .sincedb files (up to many hundred thousands even) created depending on how many logs there are and how many rotations happen which uses up a lot of space (tens of GB). I couldn't find documentation around this and was wondering what this behaviour is? Is there a way to configure logstash file input plugin to not behave like this? I.e. to just fail quickly for example if the .sincedb files are owned by a different user and to not spawn any children .sincedb files because it might fill up all the space. Cheers, ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [May 31, 2018, 10:41am UTC](https://discuss.elastic.co/t/logstash-6-2-4-file-input-plugin-spawning-a-lot-of-child-sincedb-files/134018/2 "2018-05-31T10:41:21Z")
The "child" files are an "atomic write" mechanism. Meaning that we write to another file and when done we delete `.sincedb-foo` and rename the child to `.sincedb-foo`. Otherwise Logstash could crash with an incomplete file - it still could crash in between the delete and rename but this is less likely. The `mtime` of the file listed in the config as the sincedb path should be changing about every 5 seconds. User B will need permission to rename the "child" files. ---
**Author:** ![ld\_pvl](https://avatars.discourse-cdn.com/v4/letter/l/cdc98d/32.png) [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Post date:** [May 31, 2018, 10:50am UTC](https://discuss.elastic.co/t/logstash-6-2-4-file-input-plugin-spawning-a-lot-of-child-sincedb-files/134018/3 "2018-05-31T10:50:37Z")
So I guess because user B is unable to rename child files to `.sincedb-foo` that's why the accumulation happens. Is there a way to make logstash fail when it can't rename child files? Also one interesting thing is in the logstash logs, I don't see any warns nor errors regarding it being unable to rename the child files - maybe it shows in debug mode but I haven't checked. ---
**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\ **Post date:** [May 31, 2018, 11:45am UTC](https://discuss.elastic.co/t/logstash-6-2-4-file-input-plugin-spawning-a-lot-of-child-sincedb-files/134018/4 "2018-05-31T11:45:44Z")
No, I'm afraid not. We only do the atomic write when not on Windows and the sincedb\_path is not a `/dev/null`. We don't usually get the chance to view the way the code reacts to these scenarios - the permutations are many. It used to be in the past when the file input open all found files there could be no file handles free to write/rename the sincedb file. We are only trapping the EACCES error code (Permission denied) from the [list of Posix system errors](https://gist.github.com/nelsonsar/549f7167aa2091afafa5) so any other error would rise up to the main error handling in the pipeline, causing the input to be restarted (continually). To truly handle this correctly, we need to validate the `sincedb_path` setting to actually complete a full atomic write with dummy data so that Logstash would halt with a Config Validation error rather than trying to continue. This is doable. First [this PR must be merged](https://github.com/logstash-plugins/logstash-input-file/pull/194). Please create an issue in the file input repo labelled as "enhancement". ---
**Author:** ![ld\_pvl](https://avatars.discourse-cdn.com/v4/letter/l/cdc98d/32.png) [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Post date:** [May 31, 2018, 1:09pm UTC](https://discuss.elastic.co/t/logstash-6-2-4-file-input-plugin-spawning-a-lot-of-child-sincedb-files/134018/5 "2018-05-31T13:09:40Z")
Thanks a lot for the answer! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 28, 2018, 1:09pm UTC](https://discuss.elastic.co/t/logstash-6-2-4-file-input-plugin-spawning-a-lot-of-child-sincedb-files/134018/6 "2018-06-28T13:09:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.