0

What is the best practice to avoid this case Example,

filebeat   5098  5128       root    3r      REG              253,1 31035908096     657022 /var/log/aaa/aaa.access.log.1 (deleted)

There is a logrotate to mv aaa.access.log file while processed by filebeat. nano and tail can be stucking a file but i am focusing on filebeat app. What is the best practice to solve this permanently ? Especially, filebeat app.

Nicky Puff
  • 117
  • 10
  • 1
    Since filebeat is long-running, you will likely need the copytruncate option offered by logrotate. – Haxiel Jan 07 '19 at 07:53
  • @Haxiel i have 166 ansible scripts. Adding `copytruncate` to each file is not good idea. I know it works. But do you have other way to avoid that pls ? – Nicky Puff Jan 07 '19 at 09:57
  • 2
    I'm not quite sure what you mean. The QA you've linked shows how to solve this manually by truncating the file. Since you're already using logrotate, copytruncate will do this automatically. What's missing here? – Haxiel Jan 07 '19 at 10:35
  • @Haxiel nvm, got it mate – Nicky Puff Jan 08 '19 at 00:53

0 Answers0