8 Replies Latest reply on Jul 23, 2018 11:56 AM by porzech

    DellEMC Networker rotating files strange monitoring behaviour

    porzech Novice

      I have Dell EMC Networker which is generating logs to /nsr/logs folder with raw daemon.raw file and its daemon.txt text file version.

      Those files are being rotated periodically to files with the date and time of rotation in its name eg. daemon_180425_085159.raw and daemon_180425_085159.txt.

      The deamon.raw file and its corresponding daemon.txt stay with current log, while copied file has previous logs.

      Aditionally while files are rotated there is a message in the log file informing of change of the log file, eg "Copy of /nsr/log/daemon.raw to /nsr/logs/daemon_180425_085159.raw was successful, /nst/logs/daemon.raw has been truncated" - the numbers within underscore inform about the date and time of rotation (in this case is 25.04.2018 and 08:51 and 59 sec).


      I have set up monitoring of text files with with vRLI using parameter include file set to: daemon.txt; daemon*.txt which allows of monitoring daemon.txt while it is being rotated with copy-truncate mechnism.


      Now there is a following problem that I am observing:

      1. after the vRLI agent is started it will start monitoring damon.txt file correctly until the first rotation
      2. after the log file is rotated, vRLI treats copied file (with numbers in its name) as current log file, while it stops getting information about current log daemon.txt file.
      3. Copied file is being monitored for 1 hour and after 1 hour none of the files is being monitored.
      4. in the meantime there are a few rotation of above files but as I have written nothing is being monitored.
      5. then afer a few hours suddenly a new copied file is being monitored though in the meantime a few rotation of log files take place - still current log file is not beeing monitored.
      6. It may never happen that current log file is being monitored or it may happen randomly until vRLI agent is restarted - then we start with number 1 from this list.


      Anybody can decipher the cause of the problem from what I have written above? Any ideas?