# Sincedb minor device number changes in Linux VM | alternative sincedb configurations options?

**URL:** <https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506>\
**Category:** Logstash\
**Created:** [March 15, 2024, 3:16pm UTC](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506 "2024-03-15T15:16:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![flomickl](https://avatars.discourse-cdn.com/v4/letter/f/ea5d25/32.png) [@flomickl](https://discuss.elastic.co/u/flomickl)\
**Post date:** [March 15, 2024, 3:16pm UTC](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506/1 "2024-03-15T15:16:12Z")

</div>

Hi,

I have a Logstash -\> Elasticsearch set p. Everything is working as expected, but I have a problem with the sincedb or better with my Linux VM underneath.

If I reboot the system, the device number of the partition is changing.  
So Logstash thinks it has to import the log file again.

For better understanding here my setup  
My pipeline.conf with the sincedb setup

```auto
 input {
  file {
    path => [
              "/usr/share/logstash/logs/localhost_access_log*.gz"
            ]
    start_position => "beginning"
    mode => "read"
    sincedb_path => "/usr/share/logstash/sincedb/my_sincedb"
  }
}
...

```

sincedb content after first import

```auto
151074174 0 64769 41343 1710406427.02369 /usr/share/logstash/logs/localhost_access_log.2023-09-30.txt.gz 

```

And after the reboot a cleary sign that the device number has changed

```auto
151074174 0 64769 41343 1710406427.02369 /usr/share/logstash/logs/localhost_access_log.2023-09-30.txt.gz 
151074174 0 64772 41343 1710481076.099891 /usr/share/logstash/logs/localhost_access_log.2023-09-30.txt.gz 

```

I can't do anything about the vm configuration atm because it is not in my hand but if I call `stat -c "%D" /usr/share/logstash/logs/localhost_access_log.2023-09-30.txt.gz`

I can clearly see the same changes to support my theory 😉

Are there any other ways to set up sincedb to rely on something other than the minor device number? Are there any other options I have?

Many thanks in advance for any hints.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 15, 2024, 3:46pm UTC](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506/2 "2024-03-15T15:46:51Z")

</div>

> [@flomickl](#):
>
> `/usr/share/logstash/logs/`

Is this path a network share or it is a path inside the vm disk?

---

<div class="post-metadata">

**Author:** ![flomickl](https://avatars.discourse-cdn.com/v4/letter/f/ea5d25/32.png) [@flomickl](https://discuss.elastic.co/u/flomickl)\
**Post date:** [March 15, 2024, 4:19pm UTC](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506/3 "2024-03-15T16:19:22Z")

</div>

To be honest, I don't know exactly what type it is atm.  
I will try to find out. My first guess is vm disk.  
What would be the difference in context of the device number?

If I do a stat on some files before and after reboot this is the stat output

```auto
stat /usr/share/logstash/logs/localhost_access_log.2024-01-24.txt.gz
...
  Size: 14469 Blocks: 32 IO Block: 4096 regular file
Device: fd04h/64772d Inode: 151673571 Links: 1
Access: (0775/-rwxrwxr-x) Uid: ( 1000/logstash) Gid: ( 1000/ logstash)
Access: 2024-03-15 00:46:03.241302011 +0100
Modify: 2024-01-24 07:44:55.607909195 +0100
Change: 2024-01-26 06:35:02.028559558 +0100
 Birth: 2024-01-26 06:35:02.014559520 +0100

```

```auto
stat /usr/share/logstash/logs/localhost_access_log.2024-01-24.txt.gz
...
  Size: 14469 Blocks: 32 IO Block: 4096 regular file
Device: fd01h/64769d Inode: 151673571 Links: 1
Access: (0775/-rwxrwxr-x) Uid: ( 1000/logstash) Gid: ( 1000/ logstash)
Access: 2024-03-15 00:46:03.241302011 +0100
Modify: 2024-01-24 07:44:55.607909195 +0100
Change: 2024-01-26 06:35:02.028559558 +0100
 Birth: 2024-01-26 06:35:02.014559520 +0100

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 15, 2024, 4:56pm UTC](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506/4 "2024-03-15T16:56:48Z")

</div>

> [@flomickl](#):
>
> Are there any other ways to set up sincedb to rely on something other than the minor device number?

No, filewatch assumes that the same device will have the same device number, and uses that to track the file, not the name.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2024, 4:57pm UTC](https://discuss.elastic.co/t/sincedb-minor-device-number-changes-in-linux-vm-alternative-sincedb-configurations-options/355506/5 "2024-04-12T16:57:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.