DellEMC Networker rotating files strange monitoring behaviour

[porzech]

I have Dell EMC Networker which is generating logs to /nsr/logs folder with raw daemon.raw file and its daemon.txt text file version.

Those files are being rotated periodically to files with the date and time of rotation in its name eg. daemon_180425_085159.raw and daemon_180425_085159.txt.

The deamon.raw file and its corresponding daemon.txt stay with current log, while copied file has previous logs.

Aditionally while files are rotated there is a message in the log file informing of change of the log file, eg "Copy of /nsr/log/daemon.raw to /nsr/logs/daemon_180425_085159.raw was successful, /nst/logs/daemon.raw has been truncated" - the numbers within underscore inform about the date and time of rotation (in this case is 25.04.2018 and 08:51 and 59 sec).

I have set up monitoring of text files with with vRLI using parameter include file set to: daemon.txt; daemon*.txt which allows of monitoring daemon.txt while it is being rotated with copy-truncate mechnism.

Now there is a following problem that I am observing:

1. after the vRLI agent is started it will start monitoring damon.txt file correctly until the first rotation
2. after the log file is rotated, vRLI treats copied file (with numbers in its name) as current log file, while it stops getting information about current log daemon.txt file.
3. Copied file is being monitored for 1 hour and after 1 hour none of the files is being monitored.
4. in the meantime there are a few rotation of above files but as I have written nothing is being monitored.
5. then afer a few hours suddenly a new copied file is being monitored though in the meantime a few rotation of log files take place - still current log file is not beeing monitored.
6. It may never happen that current log file is being monitored or it may happen randomly until vRLI agent is restarted - then we start with number 1 from this list.

Anybody can decipher the cause of the problem from what I have written above? Any ideas?

Thanks

Pawel

[daphnissov]

What version of vRLI is this and what is your agent version?

[porzech]

Of course, the basic information:-) Sorry for that.

Agent 4.3.0.5052904 and Server 4.5.1.

[daphnissov]

Any reason your agent isn't up-to-date with your vRLI server version?

[porzech]

Not any serious reason. Just have upgraded server last week, and I am bit cautious since we are monitoring quite a big MS Exchange environment here so just need to approach upgrade carefully. And in the meantime I wanted to prepare for Networker monitoring.

[daphnissov]

I'd recommend getting that agent upgraded to match the version of your vRLI server instance first. It's a super simple upgrade with extremely low risk, so it shouldn't be an issue.

[porzech]

I will update then and we wll see:-)

[porzech]

Just after the last post I have upgraded LI Agent to the same version as the server.

From then I have not touch anything and just today checked the status:

• The upgrade has not helped.
• The entries from the first agent start through each rotation to rotation of logs become rarer and finally after not more than 2 days they disappear completely - agent still send other info to server.
• Finally there are no Networker files being imported/read as today.
• Moreover, just digging into the problem I found out that there is also problem with /var/log/messages that behave in very similar way: they are collected for hald a day and after file rotation the collections is stopped, then after a few days, they appear again.

The appliance is SLES 12SP1 which is supported Linux distribution.

[porzech · Accepted solution]

The problem was finaly solved after upgrading to the latest Log Insight version 4.6.