Logs rotation

[ramialkhawaldeh]

Logs rotation

[patrick-stephens]

Log rotation is nothing to do with Fluent Bit, it is done by whatever system you have configured. Fluent Bit just reads the files, it never deletes them.

[ramialkhawaldeh]

@patrick-stephens but I see this on fluenbit logs [2024/05/01 09:05:09] [ info] [input:tail:tail.21] inode=327161765 handle rotation(): /var/log/containers/coroot-node-agent-vkpk2_coroot_node-agent-7d35f61d78527813f978d3c77c26bde05445b380f164e72d1209c81be2d239c8.log => /var/log/pods/coroot_coroot-node-agent-vkpk2_ea706eac-8211-41b5-af12-453bf137ec31/node-agent/109.log (deleted) [2024/05/01 09:06:49] [ info] [input:tail:tail.21] inode=174064133 handle rotation(): /var/log/containers/coroot-node-agent-2sz8l_coroot_node-agent-af39e847752ab14d2dafb3a06fedc12a9dcb01ca2b71291e09b0d20bbcc66948.log => /var/log/pods/coroot_coroot-node-agent-2sz8l_70bf0f33-2a0e-4e33-b4a6-976e4371f4ef/node-agent/127.log (deleted)

[patrick-stephens]

It's not deleting the logs themselves though, it's telling you it's handling rotation and managing any references removed

[patrick-stephens]

The easiest way to prove it is by making sure your logs mount is read-only into the FB container then it cannot delete them. However it is not deleting the actual files, the kubelet manages log rotation for you and Fluent Bit is then telling you files are being deleted but it is handling the rotation.

You could also just not deploy Fluent Bit and watch your log files still rotate... :)

[patrick-stephens]

See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation

[patrick-stephens]

I'm going to close this as I do not think it is related to Fluent Bit but feel free to reopen if so - please follow the issue template then if you do to capture all the relevant information.