<![CDATA[Logparser]]>Hi,

We are trying to monitor backup log file using logwatch subagent. From test files everything works fine, but when we finally try the actual file, we receive this message:

LogParser: file size for fstat(3) is greater then for
stat(C:\Program Files\Cobian Backup 11\Logs\log.txt), assume file rename

The parser is very simple, just:

<parser>
    <file>C:\Program Files\Cobian Backup 11\Logs\log.txt</file>
    <rules>
        <rule>
            <match>ERR (20.*)</match>
            <event params="1">100083</event>
        </rule>
    </rules>
</parser>

What could be the problem?

I upgraded server and agent to the latest version.

Best regards,
Nikk

]]>https://forum.netxms.org/topic/4225/logparserRSS for NodeFri, 13 Nov 2026 06:39:45 GMTMon, 11 Jan 2016 15:35:06 GMT60<![CDATA[Reply to Logparser on Wed, 19 Oct 2016 12:20:10 GMT]]>Do you find the solution for that? I have problem with log file encoding in cobian. It is UCS-2 LE BOM (notepad ++ showing) and the parser not working

]]>https://forum.netxms.org/post/21169https://forum.netxms.org/post/21169Wed, 19 Oct 2016 12:20:10 GMT<![CDATA[Reply to Logparser on Thu, 14 Jan 2016 08:18:00 GMT]]>Hi,

such message is usual when log rotation occurs. To detect log rotation agent compares size returned by stat using file name, and size returned for currently open file descriptior. If first is smaller, it assumes that file was rotated, re-open it, and start reading from the beginning. How often you got this message and is this file actually rotated?

Best regards,
Victor

]]>https://forum.netxms.org/post/18842https://forum.netxms.org/post/18842Thu, 14 Jan 2016 08:18:00 GMT