logwatcher
logwatcher copied to clipboard
Small chance to partially match the line
I'm currently watching this nginx log file, and there seems to be an issue where it sometimes only captures parts of the line, and with the next entry capturing the rest of the line.
With 8076216 lines read in the span of 24 hours, it failed to get the whole line 8 times, so about an error rate of 1/8000000 (0.0001%)
The code used triggering this bug: Full source
fn main() {
let mut log_watcher = LogWatcher::register("/var/log/nginx/access.log".to_string()).unwrap();
let mut log: Vec<Logger> = vec![];
log_watcher.watch(&mut move |line: String| {
let logger = match Logger::from_line(&line) { // Here it validates and creates a `Logger` object.
Ok(l) => l,
Err(e) => {
eprintln!("{e}");
eprintln!("Failed? {}", line);
return LogWatcherAction::None;
}
};
log.push(logger);
// etc etc
return LogWatcherAction::None;
})
}
Once every ~1000000 lines seen, it may land in the Err(e) and print the line twice like so:
Failed? 2a01:cb19:xxxx:xxxx::xxxx - - [14/Dec/2024:18:16:09 +0000] "example.c
Failed? om" "GET /search/example%20search%202 HTTP/2.0" 200 38580 "https://example.com/search/example%20search" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0.0"
I have compared the actual log with the times it has failed to validate the line, and the log file does indeed look normal compared to what logwatcher is reporting.