logwatcher icon indicating copy to clipboard operation
logwatcher copied to clipboard

Small chance to partially match the line

Open Aadniz opened this issue 1 year ago • 0 comments

I'm currently watching this nginx log file, and there seems to be an issue where it sometimes only captures parts of the line, and with the next entry capturing the rest of the line.

With 8076216 lines read in the span of 24 hours, it failed to get the whole line 8 times, so about an error rate of 1/8000000 (0.0001%)

The code used triggering this bug: Full source

fn main() {
    let mut log_watcher = LogWatcher::register("/var/log/nginx/access.log".to_string()).unwrap();
    let mut log: Vec<Logger> = vec![];

    log_watcher.watch(&mut move |line: String| {
        let logger = match Logger::from_line(&line) { // Here it validates and creates a `Logger` object.
            Ok(l) => l,
            Err(e) => {
                eprintln!("{e}");
                eprintln!("Failed? {}", line);
                return LogWatcherAction::None;
            }
        };

        log.push(logger);
        // etc etc

        return LogWatcherAction::None;
    })
}

Once every ~1000000 lines seen, it may land in the Err(e) and print the line twice like so:

Failed? 2a01:cb19:xxxx:xxxx::xxxx - - [14/Dec/2024:18:16:09 +0000] "example.c
Failed? om" "GET /search/example%20search%202 HTTP/2.0" 200 38580 "https://example.com/search/example%20search" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/114.0.0.0"

I have compared the actual log with the times it has failed to validate the line, and the log file does indeed look normal compared to what logwatcher is reporting.

Aadniz avatar Dec 14 '24 20:12 Aadniz