Zabbix Agent Log monitoring constantly pulling the same logs

[dom_b]

I've configured a log monitoring to pull log data, however it is just constantly pulling the same log data over and over. It's configured as follows with a macro for the log path.



I've tried lowering the log check time to 1min, increasing it to 1second. The behaviour is the same using either logrt or log. The log is sporadically written to. Even though the log hasn't been modified for hours the same events from the start of the log are being sent to the zabbix server as new events.

This is using Zabbix 6.0.16 (containers) and Zabbix Agent 2 on Windows.

Curiously in the logs the log size is reporting that it is constantly changing, however the file hasn't been modified in 12 hours...

2023/06/20 09:32:41.345030 process_logrt() new file list: (mtime:0 lastlogsize:0 start_idx:0)
2023/06/20 09:32:41.345030 nr:0 filename:'D:\Transfer Logs\transfer.log' mtime:0 size:222349 processed_size:0 seq:0 copy_of:-1 incomplete:0 dev:0 ino_hi:0 ino_lo:0 md5_block_size:512 first_block_md5:2cce4e1f7911f8e9351bec48043266bf last_block_offset:221837 last_block_md5:04363736f37e0603bb725774cb3bedba
2023/06/20 09:32:41.345030 In process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:0 mtime:0 seek_offset:0
2023/06/20 09:32:41.345549 End of process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:5376 mtime:0 ret:SUCCEED processed_bytes:5376
2023/06/20 09:32:41.345549 In process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:5376 mtime:0 seek_offset:5376
2023/06/20 09:32:41.345549 End of process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:5376 mtime:0 ret:SUCCEED processed_bytes:0
2023/06/20 09:32:41.345549 End of process_logrt():SUCCEED
2023/06/20 09:32:41.345549 executed exporter task for itemid:178606 key 'log[D:\Transfer Logs\transfer.log]'
2023/06/20 09:32:41.346068 [101] upload history data, 51/100 value(s)
2023/06/20 09:32:41.347109 executing exporter task for itemid:178001 key 'system.cpu.util'
2023/06/20 09:32:41.347628 executed exporter task for itemid:178001 key 'system.cpu.util'
2023/06/20 09:32:41.374386 connection established using TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
2023/06/20 09:32:42.342826 plugin Cpu: executing collector task
2023/06/20 09:32:42.342826 plugin WindowsPerfMon: executing collector task
2023/06/20 09:32:42.342826 executing exporter task for itemid:178002 key 'system.swap.size[,free]'
2023/06/20 09:32:42.342826 executed exporter task for itemid:178002 key 'system.swap.size[,free]'
2023/06/20 09:32:42.342826 executing exporter task for itemid:178606 key 'log[D:\Transfer Logs\transfer.log]'
2023/06/20 09:32:42.342826 In process_logrt() flags:0x05 filename:'D:\Transfer Logs\transfer.log' lastlogsize:5376 mtime:0
2023/06/20 09:32:42.343349 In add_logfile() filename:'D:\Transfer Logs\transfer.log' mtime:0 size:222349
2023/06/20 09:32:42.343349 add_logfile() logfiles:00000216EFFB69F0 logfiles_alloc:64
2023/06/20 09:32:42.343349 End of add_logfile()
2023/06/20 09:32:42.343871 log files reside on 'ReFS' file system
2023/06/20 09:32:42.343871 create_old2new_and_copy_of(): is_same_file(D:\Transfer Logs\transfer.log, D:\Transfer Logs\transfer.log) = 1
2023/06/20 09:32:42.343871 process_logrt() old file list:
2023/06/20 09:32:42.343871 nr:0 filename:'D:\Transfer Logs\transfer.log' mtime:0 size:222349 processed_size:5376 seq:2 copy_of:-1 incomplete:0 dev:0 ino_hi:0 ino_lo:0 md5_block_size:512 first_block_md5:2cce4e1f7911f8e9351bec48043266bf last_block_offset:221837 last_block_md5:04363736f37e0603bb725774cb3bedba
2023/06/20 09:32:42.343871 process_logrt() new file list: (mtime:0 lastlogsize:5376 start_idx:0)
2023/06/20 09:32:42.343871 nr:0 filename:'D:\Transfer Logs\transfer.log' mtime:0 size:222349 processed_size:5376 seq:0 copy_of:-1 incomplete:0 dev:0 ino_hi:0 ino_lo:0 md5_block_size:512 first_block_md5:2cce4e1f7911f8e9351bec48043266bf last_block_offset:221837 last_block_md5:04363736f37e0603bb725774cb3bedba
2023/06/20 09:32:42.343871 In process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:5376 mtime:0 seek_offset:5376
2023/06/20 09:32:42.344392 End of process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:10864 mtime:0 ret:SUCCEED processed_bytes:5488
2023/06/20 09:32:42.344392 In process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:10864 mtime:0 seek_offset:10864
2023/06/20 09:32:42.344392 End of process_log() filename:'D:\Transfer Logs\transfer.log' lastlogsize:10864 mtime:0 ret:SUCCEED processed_bytes:0
2023/06/20 09:32:42.344392 End of process_logrt():SUCCEED
2023/06/20 09:32:42.344392 executed exporter task for itemid:178606 key 'log[D:\Transfer Logs\transfer.log]'
2023/06/20 09:32:42.344912 [101] upload history data, 52/100 value(s)
2023/06/20 09:32:42.373083 connection established using TLSv1.3 TLS_CHACHA20_POLY1305_SHA256
2023/06/20 09:32:43.344069 plugin Cpu: executing collector task
2023/06/20 09:32:43.344069 plugin WindowsPerfMon: executing collector task
2023/06/20 09:32:43.344069 executing exporter task for itemid:178003 key 'system.swap.size[,pfree]'
2023/06/20 09:32:43.344069 executed exporter task for itemid:178003 key 'system.swap.size[,pfree]'
2023/06/20 09:32:43.344069 executing exporter task for itemid:178606 key 'log[D:\Transfer Logs\transfer.log]'
2023/06/20 09:32:43.344591 In process_logrt() flags:0x05 filename:'D:\Transfer Logs\transfer.log' lastlogsize:10864 mtime:0
2023/06/20 09:32:43.344591 In add_logfile() filename:'D:\Transfer Logs\transfer.log' mtime:0 size:222349
2023/06/20 09:32:43.344591 add_logfile() logfiles:00000216EFFB8800 logfiles_alloc:64
2023/06/20 09:32:43.344591 End of add_logfile()
2023/06/20 09:32:43.345111 log files reside on 'ReFS' file system
2023/06/20 09:32:43.345111 create_old2new_and_copy_of(): is_same_file(D:\Transfer Logs\transfer.log, D:\Transfer Logs\transfer.log) = 1 zz0.9our30ou69vzz

[dom_b]

After reading the logs again I've moved the logs files from the ReFS filesystem to an NTFS filesystem, this seems to have resolved the issue...

Is ReFS an issue for the log agent?

[cyber]

It should not be an issue... But You can still submit a bug report with your debug log and see, what they say...

https://support.zabbix.com/browse/ZBX