Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] journald log start_position=forceEnd doesn't take effect #20416

Open
at-wat opened this issue Oct 26, 2023 · 0 comments
Open

[BUG] journald log start_position=forceEnd doesn't take effect #20416

at-wat opened this issue Oct 26, 2023 · 0 comments

Comments

@at-wat
Copy link
Contributor

at-wat commented Oct 26, 2023

Agent Environment

At least on datadog-agent 7.46.0 and 7.48.1
Tested with systemd 246.15 and 253.7

Describe what happened:
When journald log start_position is set to forceEnd, all old logs are uploaded on agent start.

conf.d/journald.yaml

logs:
  - type: journald
    start_position: forceEnd
    include_units:
      ...

Describe what you expected:
Only logs after starting datadog-agent is uploaded when setting start_position: forceEnd

Steps to reproduce the issue:

  1. Set journald log start_position config to forceEnd
  2. Start datadog-agent
  3. Check uploaded logs (logs before agent start time is uploaded)

Additional environment details (Operating System, Cloud provider, etc):

Identified bug details
Journald tailer calls journal.SeekHead and journal.SeekTail,

if mode == config.ForceBeginning {
return t.journal.SeekHead()
}
if mode == config.ForceEnd {
return t.journal.SeekTail()
}

but document of sdjournal says:
https://pkg.go.dev/github.com/coreos/go-systemd/[email protected]/sdjournal#Journal.SeekHead

This call must be followed by a call to Next before any call to Get* will return data about the first element.

https://pkg.go.dev/github.com/coreos/go-systemd/[email protected]/sdjournal#Journal.SeekTail

This call must be followed by a call to Previous before any call to Get* will return data about the last element.

I confirmed forceEnd behavior is fixed by adding journal.Previous after journal.SeekTail.
seqsense/datadog-agent-alpine#106

I'll open a PR to fix this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants