What happens when truncating file?

(Iqjumps) #1

I use logrotate utility and it executes ftruncate(fdcurr, 0) in copytruncate mode
When it truncates file which Filebeat was reading, Will Filebeat's offset reset to zero or throw error?


(Noémi Ványi) #2

It will resume to read the file from the beginning. It also emits the following message: "File was truncated. Begin reading file from offset 0".

(Iqjumps) #3

Looks good. Thanks a lot

(Noémi Ványi) #4

But please note, if Filebeat hasn't finished processing the file and logrotate truncates the file, it can lead to log loss.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.