Logparser

[Nikk]

Hi,

We are trying to monitor backup log file using logwatch subagent. From test files everything works fine, but when we finally try the actual file, we receive this message:

LogParser: file size for fstat(3) is greater then for
stat(C:\Program Files\Cobian Backup 11\Logs\log.txt), assume file rename

The parser is very simple, just:

<parser>
    <file>C:\Program Files\Cobian Backup 11\Logs\log.txt</file>
    <rules>
        <rule>
            <match>ERR (20.*)</match>
            <event params="1">100083</event>
        </rule>
    </rules>
</parser>

What could be the problem?

I upgraded server and agent to the latest version.

Best regards,
Nikk

[victor]

Hi,

such message is usual when log rotation occurs. To detect log rotation agent compares size returned by stat using file name, and size returned for currently open file descriptior. If first is smaller, it assumes that file was rotated, re-open it, and start reading from the beginning. How often you got this message and is this file actually rotated?

Best regards,
Victor

[dersonik]

Do you find the solution for that? I have problem with log file encoding in cobian. It is UCS-2 LE BOM (notepad ++ showing) and the parser not working