search

graylog-labs / collector

[DEPRECATED] The Graylog Collector
https://www.graylog.org
GNU General Public License v3.0
40 stars 16 forks source link

Windows Server: Graylog 0.4.0 stdout leaking #61

Open monaghans-andrew-munro opened 9 years ago

monaghans-andrew-munro commented 9 years ago

I have installed release 0.4.0 the Graylog collector on a Windows Server 2008 server, after a few days of running we noticed a low disk issue which we tracked back to the .\logs\graylog-collector-stdout file hitting 388GB.

Sadly the file was too large to open and we had to delete it to recover disk space so I am unsure of the contents but this didn't seem like a file that should be reaching this size, or in fact retaining any data.

The server is running several roles, among them is AD DS, File and Print Services, IIS, DHCP and DNS. If there are any other details that I can submit to assist with this please let me know. The server was submitting logs to Graylog and from what I can tell there are no logs which were not forwarded correctly.

joschi commented 9 years ago

Thanks for reporting this! The file you've mentioned (.\logs\graylog-collector-stdout) is simply the log output of the Graylog Collector itself and doesn't contain any of the processed and sent log messages (also see https://github.com/Graylog2/collector/blob/0.4.0/src/main/scripts/graylog-collector-service.bat#L97).

While you can safely remove that file without any impact on the Graylog Collector, it shouldn't grow that much unbounded and should rather be rotated after some time or after it reached a certain size. We'll look into this for the next version of the Graylog Collector.