logstash-forwarder icon indicating copy to clipboard operation
logstash-forwarder copied to clipboard

holding open handles on deleted files when logstash is down

Open jordanorelli opened this issue 10 years ago • 1 comments

by design, lumberjack sometimes holds onto file handles of deleted files. This is so that we can continue shipping lines from a given file even after it has been deleted, if we haven't already shipped all of the lines.

also by design: if all logstash connections are down, lumberjack will automatically wait for them to come back online before continuing.

this means that if logstash has failed completely, and lumberjack can't ship anything, it'll just open file handles on log files as they are created, and never let go of them, potentially filling disks. The alternative of letting go of the file lets the OS reclaim its disk space, but at the cost of not shipping those lines. That appears to be an acceptable tradeoff.

jordanorelli avatar Jan 29 '15 16:01 jordanorelli

Perhaps make it a configurable option in case some would rather not loose track of lines? Just an idea, I think in general it is a better tradeoff.

wjimenez5271 avatar Jan 29 '15 19:01 wjimenez5271