日志文件切换过程

1.
[oswatch@rce1 test]$ cat test.conf
input {
     file {
       path=>["/oswatch/test/test.log"]
  }
}






output {
   stdout {
     codec=>rubydebug{}
    }
}
[oswatch@rce1 test]$ logsave test.conf ^C
[oswatch@rce1 test]$ /app/app/logstash
logstash/       logstash-2.3.4/
[oswatch@rce1 test]$ /app/app/logstash-2.3.4/
bin/    etc/    lib/    vendor/
[oswatch@rce1 test]$ /app/app/logstash-2.3.4/bin/logstash -f test.conf
Settings: Default pipeline workers: 12
Pipeline main started


2.python脚本:


[oswatch@rce1 conf]$ cat t1.py
#!/usr/bin/python
# -*- coding: UTF-8 -*-
import time

# 打开一个文件
with open('/tmp/test/test.log', 'w', buffering=1)as f:
    for i in range(100000):
        f.write(str(time.time()) + "\n")
        time.sleep(1)


3.

[oswatch@rce1 ~]$ lsof -p 551314 | grep test
java    551314 oswatch  cwd    DIR              253,4        54   8416543 /oswatch/test
java    551314 oswatch    5r   REG              253,4      1433   8544960 /oswatch/test/test.log
[oswatch@rce1 ~]$ ps -ef | grep 551314
oswatch  551314 543073 11 21:51 pts/1    00:00:23 /app/app/jdk/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:

+HeapDumpOnOutOfMemoryError -Xmx1g -Xss2048k -Djffi.boot.library.path=/app/app/logstash-2.3.4/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:

+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/app/app/logstash-2.3.4/heapdump.hprof -Xbootclasspath/a:/app/app/logstash-2.3.4/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/app/app/logstash-

2.3.4/vendor/jruby -Djruby.lib=/app/app/logstash-2.3.4/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /app/app/logstash-2.3.4/lib/bootstrap/environment.rb logstash/runner.rb agent -f test.conf
oswatch  554137 552672  0 21:54 pts/3    00:00:00 grep --color=auto 551314
[oswatch@rce1 ~]$ lsof -p 551314 | grep test
java    551314 oswatch  cwd    DIR              253,4        54   8416543 /oswatch/test
java    551314 oswatch    5r   REG              253,4      1615   8544960 /oswatch/test/test.log


[oswatch@rce1 ~]$ ps -ef | grep python
root       1270      1  0  2022 ?        00:32:01 /usr/bin/python -Es /usr/sbin/tuned -l -P
root       1509      1  2  2022 ?        5-06:20:44 /opt/python2/bin/python2.7 /opt/python2/bin/supervisord -c /etc/supervisord.conf
oswatch  552603 551929  0 21:52 pts/2    00:00:00 python test.py
oswatch  555507 552672  0 21:54 pts/3    00:00:00 grep --color=auto python
[oswatch@rce1 ~]$ lsof -p 552603|grep test
python  552603 oswatch  cwd    DIR  253,4        54   8416543 /oswatch/test
python  552603 oswatch    3w   REG  253,4      2049   8544960 /oswatch/test/test.log


4.
[oswatch@rce1 ~]$ ps -ef | grep python
root       1270      1  0  2022 ?        00:32:01 /usr/bin/python -Es /usr/sbin/tuned -l -P
root       1509      1  2  2022 ?        5-06:20:44 /opt/python2/bin/python2.7 /opt/python2/bin/supervisord -c /etc/supervisord.conf
oswatch  552603 551929  0 21:52 pts/2    00:00:00 python test.py
oswatch  555507 552672  0 21:54 pts/3    00:00:00 grep --color=auto python
[oswatch@rce1 ~]$ lsof -p 552603|grep test
python  552603 oswatch  cwd    DIR  253,4        54   8416543 /oswatch/test
python  552603 oswatch    3w   REG  253,4      2049   8544960 /oswatch/test/test.log


5.mv文件 mv test.log test.log.1


logstash 不会读取 test.log.1

{
       "message" => "1691589397.2",
      "@version" => "1",
    "@timestamp" => "2023-08-09T13:56:38.052Z",
          "path" => "/oswatch/test/test.log",
          "host" => "rce1"
}



[oswatch@rce1 ~]$ ps -ef | grep logstash | grep oswatch
oswatch  551314 543073  5 21:51 pts/1    00:00:25 /app/app/jdk/bin/java -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:

+HeapDumpOnOutOfMemoryError -Xmx1g -Xss2048k -Djffi.boot.library.path=/app/app/logstash-2.3.4/vendor/jruby/lib/jni -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -Djava.awt.headless=true -XX:CMSInitiatingOccupancyFraction=75 -XX:

+UseCMSInitiatingOccupancyOnly -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/app/app/logstash-2.3.4/heapdump.hprof -Xbootclasspath/a:/app/app/logstash-2.3.4/vendor/jruby/lib/jruby.jar -classpath : -Djruby.home=/app/app/logstash-

2.3.4/vendor/jruby -Djruby.lib=/app/app/logstash-2.3.4/vendor/jruby/lib -Djruby.script=jruby -Djruby.shell=/bin/sh org.jruby.Main --1.9 /app/app/logstash-2.3.4/lib/bootstrap/environment.rb logstash/runner.rb agent -f test.conf
oswatch  558518 552672  0 21:58 pts/3    00:00:00 grep --color=auto logstash
[oswatch@rce1 ~]$ lsof -p 551314|grep test
java    551314 oswatch  cwd    DIR              253,4        56   8416543 /oswatch/test



[oswatch@rce1 ~]$ ps -ef | grep python
root       1270      1  0  2022 ?        00:32:01 /usr/bin/python -Es /usr/sbin/tuned -l -P
root       1509      1  2  2022 ?        5-06:20:49 /opt/python2/bin/python2.7 /opt/python2/bin/supervisord -c /etc/supervisord.conf
oswatch  552603 551929  0 21:52 pts/2    00:00:00 python test.py
oswatch  558897 552672  0 21:59 pts/3    00:00:00 grep --color=auto python
[oswatch@rce1 ~]$ lsof -p 552603|grep test
python  552603 oswatch  cwd    DIR  253,4        56   8416543 /oswatch/test
python  552603 oswatch    3w   REG  253,4      5771   8544960 /oswatch/test/test.log.1