logstash-forwarder
logstash-forwarder copied to clipboard
holding open handles on deleted files when logstash is down
by design, lumberjack sometimes holds onto file handles of deleted files. This is so that we can continue shipping lines from a given file even after it has been deleted, if we haven't already shipped all of the lines.
also by design: if all logstash connections are down, lumberjack will automatically wait for them to come back online before continuing.
this means that if logstash has failed completely, and lumberjack can't ship anything, it'll just open file handles on log files as they are created, and never let go of them, potentially filling disks. The alternative of letting go of the file lets the OS reclaim its disk space, but at the cost of not shipping those lines. That appears to be an acceptable tradeoff.
Perhaps make it a configurable option in case some would rather not loose track of lines? Just an idea, I think in general it is a better tradeoff.