What happens when truncating file?

Elastic Stack Beats
1

I use logrotate utility and it executes ftruncate(fdcurr, 0) in copytruncate mode
When it truncates file which Filebeat was reading, Will Filebeat's offset reset to zero or throw error?

Thanks

2

It will resume to read the file from the beginning. It also emits the following message: "File was truncated. Begin reading file from offset 0".

3

Looks good. Thanks a lot

4

But please note, if Filebeat hasn't finished processing the file and logrotate truncates the file, it can lead to log loss.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.