Unclear tailing extrapolation?

[hynek]

Hi,

I want to tail /var/log/exim4/mainlog so I run mtail using runit like this:

#!/bin/sh -e

export LC_ALL="en_US.UTF-8"

exec 2>&1 \
    chpst -u Debian-exim:Debian-exim \
        mtail -progs /etc/mtail -logs /var/log/exim4/mainlog -logtostderr

That seems to work fine, except that my log is spammed with the following message multiple times per second:

@40000000563b39770fc60854 I1105 12:11:41.264553   20836 tail.go:130] No file descriptor found for "/var/log/exim4/rejectlog

At no point did I tell mtail to care about the reject log nor do I want to tail it since it would taint the metrics. What is going wrong here?

Why does mtail think it should tail an unrelated file that happens to be in the same directory and what can I do about it? It is generating quite a bit of log data…

[SuperQ]

This is probably coming from the watcher, which uses fsnotify to know when /var/log/exim4/mainlog is rotated. I have no idea what's wrong tho.

[jaqx0r]

This seems like a bug, but certainly related to how the filesystem watcher
tracks log rotation.

I suspect it is noticing updates to that file and the message merely states
that it should ignore it.

If so, a simple fix is to downgrade the message to a lower severity.

On Fri, 6 Nov 2015, 00:13 Ben Kochie [email protected] wrote:

This is probably coming from the watcher, which uses fsnotify to know when
/var/log/exim4/mainlog is rotated. I have no idea what's wrong tho.

—
Reply to this email directly or view it on GitHub
#13 (comment).

[jaqx0r]

handleLogUpdate in mtail/tailer/tail.go:123 is called on all UpdateEvents
from the fs notifier. This includes updates on the directory, which is so
we can detect log rotation events. Unfortunately, the check for presence
occurs in the method itself, not before it's called, so that cases like
this end up triggering that log message. It's effectively harmless, but
spammy like you say.
A simple fix as I said is to downgrade the message, so I've done that, but
added a note to make it less wasteful in a future change.

On 6 November 2015 at 09:24, Jamie Wilkinson [email protected] wrote:

This seems like a bug, but certainly related to how the filesystem watcher
tracks log rotation.

I suspect it is noticing updates to that file and the message merely
states that it should ignore it.

If so, a simple fix is to downgrade the message to a lower severity.

On Fri, 6 Nov 2015, 00:13 Ben Kochie [email protected] wrote:

This is probably coming from the watcher, which uses fsnotify to know
when /var/log/exim4/mainlog is rotated. I have no idea what's wrong tho.

—
Reply to this email directly or view it on GitHub
#13 (comment).

[SuperQ]

👍 😎

[hynek]

Thanks!