What happens when truncating file?


(Iqjumps) #1

I use logrotate utility and it executes ftruncate(fdcurr, 0) in copytruncate mode
When it truncates file which Filebeat was reading, Will Filebeat's offset reset to zero or throw error?

Thanks


(Noémi Ványi) #2

It will resume to read the file from the beginning. It also emits the following message: "File was truncated. Begin reading file from offset 0".


(Iqjumps) #3

Looks good. Thanks a lot


(Noémi Ványi) #4

But please note, if Filebeat hasn't finished processing the file and logrotate truncates the file, it can lead to log loss.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.