0

I'm using Fluent Bit v4.1.1 with the tail input plugin to collect application logs written by Logback.
Log rotation works as follows:

  • test.log → renamed to test.2025-11-08.0.log

  • A new test.log is then created.

Here is the actual inotify trace from Fluent Bit:

[2025/11/08 16:15:32.65692469] [ info] [input:tail:tail.0] inode=92276569 handle rotation(): /test.log => /test.2025-11-08.0.log
[2025/11/08 16:15:32.65803710] [ info] [input:tail:tail.0] inotify_fs_remove(): inode=92276569 watch_fd=1
[2025/11/08 16:15:32.65896291] [ info] [input:tail:tail.0] inotify_fs_add(): inode=92276569 watch_fd=2 name=/test.2025-11-08.0.log
[2025/11/08 16:15:32.66060215] [ info] [input:tail:tail.0] inotify_fs_add(): inode=92276570 watch_fd=3 name=/test.log
[2025/11/08 16:16:32.415373474] [ info] [input:tail:tail.0] inotify_fs_remove(): inode=92276569 watch_fd=2
[2025/11/08 16:16:33.359858992] [ info] [input:tail:tail.0] inotify_fs_add(): inode=92276569 watch_fd=4 name=/test.2025-11-08.0.log

At this point, Fluent Bit re-reads the rotated file (test.2025-11-08.0.log) even though it already has a DB record for that same path and inode.

From /fluent-bit/db/test.db (in_tail_files table):

1|/test.2025-11-08.0.log|209718068|92276569|1762618237|1
2|/test.log|40541711|92276570|1762618532|0
3|/test.2025-11-08.0.log|209718068|92276569|1762618592|0

Row #1 already marked rotated=1, but row #3 reappears for the same inode/path, and Fluent Bit starts reading it again.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.