Search the VMware Knowledge Base (KB)
View by Article ID

VMware vRealize Log Insight Linux Agent fails to collect log files rotated with copytruncate (2120230)

  • 0 Ratings

Symptoms

  • The VMware vRealize Log Insight Linux Agent fails to collect log files rotated with copytruncate
  • The VMware vRealize Log Insight Linux Agent does not support the copytruncate rotation scheme of logrotate(8)

Cause

This issue occurs because the copytruncate rotation scheme of logrotate copies a file's contents to a new log file and truncates the original log file to zero size. The program writing the log continues to hold a file handle to its log file and may continue appending new logs. When this happens, the Log Insight Linux Agent does not identify that the log file has been truncated. New logs in this file may not be read.

Resolution

VMware vRealize Log Insight Agent 3.3 introduced support for the copytruncate rotation scheme. For more information, see the release notes.

To work around this issue where the Log Insight Agent cannot be upgraded, use a different file rotation scheme, such as the default logrotate scheme for renaming the original file followed by create. If the program writing the log file is holding open a file handle, consider notifying that running program of the rotation event.

For example, some programs reopen their log files when they receive a SIGHUP signal. In this case, modify the logrotate configuration with a postrotate command to signal the running program's process.

/var/log/program/action.log {
   create 660 proguser proggroup
   rotate 7
   size=50M
   postrotate  /usr/bin/killall -HUP program_name
}

For more information, see the logrotate(8) manual page and the documentation for the program writing the log file.

Note: The preceding link was correct as of September 16, 2015. If you find the link is broken, provide a feedback and a VMware employee will update the link.

See Also

Update History

03/01/2016 - Supported added in Log Insight 3.3

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 0 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)




Please enter the Captcha code before clicking Submit.
  • 0 Ratings
Actions
KB: