Hi,
in filebeat we discourage usage of network shares. Some common problems with network shares:
- inode (or windows volume + file ID) potentially changing (especially old CIFS implementations sharing between multiple OS types).
- file unavailability due to network problems -> file state might be gc'ed if outage takes to long -> file might be send again
- file contents being updated out of order on disc level
Out of order updates to the underlying file (or on network level) can lead to the OS inserting NULLs for missing pages, until all contents is available. This is due to the file pointer suddenly increasing by N-pages, without having contents for those N pages/blocks available yet. Any tool watching/following files will be able to read the missing area, as the total file size did increase by N+1 blocks. But tools will only get to read NULLs.
There is no support for backing off on NULL in filebeat yet. Potential solutions to the problem are (once NULL is detected):
- just close the file and hope it is picked up again on next scan
- use seek to return to last OK position in file and backoff before trying to read again.
Normally file inconsistencies don't persist for too long. Personally I'd prefer the seek-and-retry approach.