skip option doesn't work with my logrt item (6.4 zabbix version)

[sleb]

skip option doesn't work with my logrt item (6.4 zabbix version)

Hello,

I use logrt and its skip option on many hosts and applications, but in one case it doesn't work.as espected. The zabbix agent detects that there has been a modification but systematically returns all the lines in the log and not just the new lines. Fortunately for me, there aren't many lines in each rotation file (around thirty maximum). However, I need to solve this problem.

Here's what the conf looks like:
key 'logrt["/web/prod/monitors/mach_cawo/zabbix/zabbix_[0-9]{8}00.txt",,,,skip,,,]'


and some traces in the agent log (debug mode) when it detects the difference but pushes the whole file rather than the added line.

2024/07/19 07:59:02.002368 In process_logrt() flags:0x09 filename:'/web/prod/monitors/mach_cawo/zabbix/zabbix_[0-9]{8}00.txt' lastlogsize:1481 mtime:1721374550
2024/07/19 07:59:02.002386 In split_filename() filename:'/web/prod/monitors/mach_cawo/zabbix/zabbix_[0-9]{8}00.txt'
2024/07/19 07:59:02.002424 In split_string() str:'/web/prod/monitors/mach_cawo/zabbix/zabbix_[0-9]{8}00.txt' del:'/zabbix_[0-9]{8}00.txt'
2024/07/19 07:59:02.002441 End of split_string():SUCCEED part1:'/web/prod/monitors/mach_cawo/zabbix/' part2:'zabbix_[0-9]{8}00.txt'
2024/07/19 07:59:02.002462 End of split_filename():SUCCEED directory:'/web/prod/monitors/mach_cawo/zabbix/' filename_regexp:'zabbix_[0-9]{8}00.txt'
2024/07/19 07:59:02.002766 In add_logfile() filename:'/web/prod/monitors/mach_cawo/zabbix/zabbix_2024071900.txt' mtime:1721375941 size:1562
2024/07/19 07:59:02.002785 add_logfile() logfiles:0x7f3450001600 logfiles_alloc:64
2024/07/19 07:59:02.002797 End of add_logfile()
2024/07/19 07:59:02.003116 create_old2new_and_copy_of(): is_same_file(/web/prod/monitors/mach_cawo/zabbix/zabbix_2024071900.txt, /web/prod/monitors/mach_cawo/zabbix/zabbix_2024071900.txt) = 0
2024/07/19 07:59:02.003136 process_logrt() old file list:
2024/07/19 07:59:02.003210 nr:0 filename:'/web/prod/monitors/mach_cawo/zabbix/zabbix_2024071900.txt' mtime:1721374550 size:1481 processed_size:1481 seq:1 copy_of:-1 incomplete:0 dev:64768 ino_hi:0 ino_lo:46 md5_block_size:512 first_block_md5:dc54354663df678d1b6a820c01c70d55 last_block_offset:969 last_block_md5:198049e4c5f7227bc4b5e071ee7312d4
2024/07/19 07:59:02.003228 process_logrt() new file list: (mtime:1721374550 lastlogsize:0 start_idx:0)
2024/07/19 07:59:02.003249 nr:0 filename:'/web/prod/monitors/mach_cawo/zabbix/zabbix_2024071900.txt' mtime:1721375941 size:1562 processed_size:0 seq:0 copy_of:-1 incomplete:0 dev:64768 ino_hi:0 ino_lo:47 md5_block_size:512 first_block_md5:dc54354663df678d1b6a820c01c70d55 last_block_offset:1050 last_block_md5:ece0a6ed5da73fb4f2f3465c8fa1e260
2024/07/19 07:59:02.003288 In process_log() filename:'/web/prod/monitors/mach_cawo/zabbix/zabbix_2024071900.txt' lastlogsize:0 mtime:1721375941 seek_offset:0
2024/07/19 07:59:02.003407 End of process_log() filename:'/web/prod/monitors/mach_cawo/zabbix/zabbix_2024071900.txt' lastlogsize:1562 mtime:1721375941 ret:SUCCEED processed_bytes:1562
2024/07/19 07:59:02.003423 End of process_logrt():SUCCEED


Can you help me?
Thank you in advance for your support,

Séb

[sleb]

Hi Markku
I can confirm that the ID change was indeed the reason for my problem.
In our environment, the zabbix logrt controls a log directory populated by an rsync command (by default rsync changes the id of a file between 2 syncs). By adding the two rsync belowed options "-a --inplace", it no longer modifies the ids and my monitoring works as expected.

Thanks for your support
Séb

[Markku]

https://www.zabbix.com/documentation...persistent-dir says:

• mode - possible values: all (default) or skip - skip processing of older data (affects only newly created items).

so it will not help you if the file behaves somehow specially after the item creation.

In your debug the file inode seems to change: ino_hi:0 ino_lo:46 to ino_hi:0 ino_lo:47

https://www.zabbix.com/documentation...mportant-notes says:

• Do not modify the last modification time of log files with 'touch' utility, do not copy a log file with later restoration of the original name (this will change the file inode number). In both cases the file will be counted as different and will be analyzed from the start, which may result in duplicated alerts.

I don't have any other direct suggestion than to try to fix the system that generates the file to work somehow differently.

Markku

[sleb]

Thanks for the feedback Markku. I'll try to explore this possibility and let you know if it solves my problem.

[sleb]

Hi Markku
I can confirm that the ID change was indeed the reason for my problem.
In our environment, the zabbix logrt controls a log directory populated by an rsync command (by default rsync changes the id of a file between 2 syncs). By adding the two rsync belowed options "-a --inplace", it no longer modifies the ids and my monitoring works as expected.

Thanks for your support
Séb