tail doesn't release any watch descriptors watching already rotated files except for file deletion. Does it?
In my case, the number of opened watch descriptors exceeded a value of /proc/sys/fs/inotify/max_user_watches and tail was opening a renamed file. I've tested the following steps. 1) cat /proc/sys/fs/inotify/max_user_watches 2) log files are generated and tail -F the latest log file. (The number of log files exceeds max_user_watches and tail doesn't print any output to stdout.) 3) ls -l /proc/pid/fd (tailing already rotated file. It seems that tail couldn't keep track of the lastest file because of a shortage of watch descriptors.) And I think that the latest revison of tail has the same issue. May I ask you the reason why you don't release watch descriptors for renamed files? 2015-01-23 22:14 GMT+09:00 Pádraig Brady <[email protected]>: > On 23/01/15 07:51, 최종우 wrote: > > I am using GNU coreutils 8.4 with flume 1.4.0, log4j 1.2.17. > > > > I've found a problem that sometimes tail run by flume is reading a file > has been renamed by log4j. > > > > flume executed tail with following parameters: > > tail -F logfilename > > > > Fist flume had run the command, I checked file descriptors opened by > tail process: > > ls -l /proc/pid/fd > > > > 0 -> pipe:[185694192] // Sorry, I am not sure that the numbers are > correct. > > 1 -> pipe:[185694193] > > 2 -> pipe:[185694194] > > 4 -> inotify > > 5 -> logfilename > > > > After time passed, log4j had rotated the log file, I rechecked file > descriptos: > > ls -l /proc/pid/fd > > > > 0 -> pipe:[185694192] // Sorry, I am not sure that the numbers are > correct. > > 1 -> pipe:[185694193] > > 2 -> pipe:[185694194] > > 4 -> inotify > > 5 -> logfilename.1 > > > > > > tail has been being executed with a parameter '-F', but didn't follow by > name. > > This problem doesn't happen always. I don't know why this problem > happened. > > There have been many fixes to tail since version 8.4 (5 years old). > In particular, that version of tail would not notice changes to files > on remote file systems. What file system are you using? > I'd encourage you to test with a later version if possible. > Also I'd try using the undocumented ---disable-inotify option > (note the 3 dashes) to see if inotify is to blame. > > thanks, > Pádraig. >
