{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/2018","repository_url":"https://api.github.com/repos/wazuh/wazuh","labels_url":"https://api.github.com/repos/wazuh/wazuh/issues/2018/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh/issues/2018/comments","events_url":"https://api.github.com/repos/wazuh/wazuh/issues/2018/events","html_url":"https://github.com/wazuh/wazuh/issues/2018","id":386307006,"node_id":"MDU6SXNzdWUzODYzMDcwMDY=","number":2018,"title":"Logcollector prevents vmhgfs from synchronizing the inode","user":{"login":"vikman90","id":10536251,"node_id":"MDQ6VXNlcjEwNTM2MjUx","avatar_url":"https://avatars3.githubusercontent.com/u/10536251?v=4","gravatar_id":"","url":"https://api.github.com/users/vikman90","html_url":"https://github.com/vikman90","followers_url":"https://api.github.com/users/vikman90/followers","following_url":"https://api.github.com/users/vikman90/following{/other_user}","gists_url":"https://api.github.com/users/vikman90/gists{/gist_id}","starred_url":"https://api.github.com/users/vikman90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikman90/subscriptions","organizations_url":"https://api.github.com/users/vikman90/orgs","repos_url":"https://api.github.com/users/vikman90/repos","events_url":"https://api.github.com/users/vikman90/events{/privacy}","received_events_url":"https://api.github.com/users/vikman90/received_events","type":"User","site_admin":false},"labels":[{"id":246680124,"node_id":"MDU6TGFiZWwyNDY2ODAxMjQ=","url":"https://api.github.com/repos/wazuh/wazuh/labels/bug","name":"bug","color":"d93f0b","default":true},{"id":1052006459,"node_id":"MDU6TGFiZWwxMDUyMDA2NDU5","url":"https://api.github.com/repos/wazuh/wazuh/labels/logcollector","name":"logcollector","color":"b0ccf2","default":false},{"id":1133753117,"node_id":"MDU6TGFiZWwxMTMzNzUzMTE3","url":"https://api.github.com/repos/wazuh/wazuh/labels/operations","name":"operations","color":"aae021","default":false},{"id":1005867432,"node_id":"MDU6TGFiZWwxMDA1ODY3NDMy","url":"https://api.github.com/repos/wazuh/wazuh/labels/priority","name":"priority","color":"d93f0b","default":false}],"state":"open","locked":false,"assignee":{"login":"TJOSERAFAEL","id":16609513,"node_id":"MDQ6VXNlcjE2NjA5NTEz","avatar_url":"https://avatars2.githubusercontent.com/u/16609513?v=4","gravatar_id":"","url":"https://api.github.com/users/TJOSERAFAEL","html_url":"https://github.com/TJOSERAFAEL","followers_url":"https://api.github.com/users/TJOSERAFAEL/followers","following_url":"https://api.github.com/users/TJOSERAFAEL/following{/other_user}","gists_url":"https://api.github.com/users/TJOSERAFAEL/gists{/gist_id}","starred_url":"https://api.github.com/users/TJOSERAFAEL/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TJOSERAFAEL/subscriptions","organizations_url":"https://api.github.com/users/TJOSERAFAEL/orgs","repos_url":"https://api.github.com/users/TJOSERAFAEL/repos","events_url":"https://api.github.com/users/TJOSERAFAEL/events{/privacy}","received_events_url":"https://api.github.com/users/TJOSERAFAEL/received_events","type":"User","site_admin":false},"assignees":[{"login":"TJOSERAFAEL","id":16609513,"node_id":"MDQ6VXNlcjE2NjA5NTEz","avatar_url":"https://avatars2.githubusercontent.com/u/16609513?v=4","gravatar_id":"","url":"https://api.github.com/users/TJOSERAFAEL","html_url":"https://github.com/TJOSERAFAEL","followers_url":"https://api.github.com/users/TJOSERAFAEL/followers","following_url":"https://api.github.com/users/TJOSERAFAEL/following{/other_user}","gists_url":"https://api.github.com/users/TJOSERAFAEL/gists{/gist_id}","starred_url":"https://api.github.com/users/TJOSERAFAEL/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TJOSERAFAEL/subscriptions","organizations_url":"https://api.github.com/users/TJOSERAFAEL/orgs","repos_url":"https://api.github.com/users/TJOSERAFAEL/repos","events_url":"https://api.github.com/users/TJOSERAFAEL/events{/privacy}","received_events_url":"https://api.github.com/users/TJOSERAFAEL/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-11-30T18:50:21Z","updated_at":"2018-11-30T19:15:31Z","closed_at":null,"author_association":"MEMBER","body":"Logcollector periodically performs file and size checkings for every monitored file. It the daemon detects that the file was reduced or rotated, it reloads the file.\r\n\r\nThe vmhgfs file system (for VMware shared folders) synchronizes the file inode number from the host to the guest, but it can only do that if no process has the file open. In other words, Logcollector prevents the file system from updating the file inode.\r\n\r\nIf Logcollector is monitoring a file in a shared folder, and that file is rotated —replaced by another file with the same name— in the host machine, the vmhgfs file system can't update the inode number, then Logcollector does not detect the file rotation.\r\n\r\n## Proposed fix\r\n\r\nWe should introduce a feature in Logcollector that forces file reloading although no size or inode change is detected. This feature may be switched by a global option, like:\r\n\r\n### `logcollector.force_reload`\r\n\r\nAllowed values:\r\n- `0`: disabled.\r\n- `1`: enabled.\r\n\r\nDefault value: `0` (disabled).\r\n\r\nIf Logcollector performs a file reloading, it should also re-check the inode number. If the inode has changed now, Logcollector should report that the file has been rotated."},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/comments/443309175","html_url":"https://github.com/wazuh/wazuh/issues/2018#issuecomment-443309175","issue_url":"https://api.github.com/repos/wazuh/wazuh/issues/2018","id":443309175,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MzMwOTE3NQ==","user":{"login":"irctrakz","id":3270185,"node_id":"MDQ6VXNlcjMyNzAxODU=","avatar_url":"https://avatars3.githubusercontent.com/u/3270185?v=4","gravatar_id":"","url":"https://api.github.com/users/irctrakz","html_url":"https://github.com/irctrakz","followers_url":"https://api.github.com/users/irctrakz/followers","following_url":"https://api.github.com/users/irctrakz/following{/other_user}","gists_url":"https://api.github.com/users/irctrakz/gists{/gist_id}","starred_url":"https://api.github.com/users/irctrakz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/irctrakz/subscriptions","organizations_url":"https://api.github.com/users/irctrakz/orgs","repos_url":"https://api.github.com/users/irctrakz/repos","events_url":"https://api.github.com/users/irctrakz/events{/privacy}","received_events_url":"https://api.github.com/users/irctrakz/received_events","type":"User","site_admin":false},"created_at":"2018-11-30T19:15:31Z","updated_at":"2018-11-30T19:15:31Z","author_association":"NONE","body":"The frequency of the reload should be independently configurable, so as to help avoid continual file reloading - a resource expensive task.\r\n\r\nAdditionally, the position of the file needs to be maintained across reload, to avoid re-processing the same data over and over."}}
{"actor":{"display_login":"irctrakz"}}