Hi everyone, I'm trying to understand the exact d...
# fluent-bit
g
Hi everyone, I'm trying to understand the exact data loss mechanism for the tail input plugin when using storage.type = memory (default) and the plugin gets paused due to mem_buf_limit being reached. The documentation says:
"if a file rotates while the plugin is paused, data can be lost"
and also:
"The tail plugin can handle pause without data loss; it will store its current file offset and resume reading later."
In our setup, log files are never rotated - they are continuously appended to. Given that: 1. tail saves its file offset when paused 2. tail resumes reading from the saved offset when unpaused 3. the file is never rotated or deleted Is there actually a data loss scenario here? Or is the data loss risk strictly limited to file rotation/deletion during pause? We're running Fluent Bit 4.2 with ~28 tail inputs, and we see frequent pause/resume cycles under backpressure. We want to understand if we need to switch to filesystem storage even though our files don't rotate. Thanks!
p
Sounds alright to me but I'd always verify it locally - should be easy enough to do a simple local test case to confirm. I presume you mean you're using the
db
option as well? You may want that to cope with FB restart too, e.g. OOMs or some other way it gets restarted (upgrade maybe?).
e
You might be interested in exploring the theory behind data loss in these two workshop labs: https://o11y-workshops.gitlab.io/workshop-fluentbit/#/7 https://o11y-workshops.gitlab.io/workshop-fluentbit/#/8
g
yes, we do use the db option on all tail inputs
Thanks for the links! I went through the workshop labs - very helpful for understanding the backpressure mechanics. We're planning to switch to storage.type = filesystem eventually, but we'd really like to understand the root cause first. We're still seeing data loss and want to figure out what's going on. Here's our situation: - storage.type = memory (default) - Retry_Limit = False (unlimited retries) - db is enabled on all tail inputs - No OOM kills observed - We see paused/resumed (mem buf overlimit) cycles - The lost data is lines from the middle of files, not the tail end - threaded: true on the tail input. Our input config: - name: tail read_from_head: true refresh_interval: 5 inotify_watcher: false skip_empty_lines: false skip_long_lines: false mem_buf_limit: 30Mb buffer_chunk_size: 32Kb buffer_max_size: 2Mb threaded: true static_batch_size: 5Mb event_batch_size: 5Mb db: /fluent-bit/data/test.db Our output config: - name: tcp match: test format: msgpack workers: 1 retry_limit: false net.keepalive: true net.keepalive_idle_timeout: 3600 Are there any other known edge cases in the memory storage engine where chunks can be silently dropped without an OOM event?
Some context on our file management: we have a script that periodically copies log files into the directory that tail monitors, and also cleans up old files from that directory. However, we only validate data integrity for files that still exist at the time of checking - we don't count deleted files as data loss. The losses we're seeing are missing lines from files that are present and fully readable on disk.