I'm using Fluent Bit v4.1.1 with the tail input plugin to collect application logs written by Logback.
Log rotation works as follows:
test.log→ renamed totest.2025-11-08.0.logA new
test.logis then created.
Here is the actual inotify trace from Fluent Bit:
[2025/11/08 16:15:32.65692469] [ info] [input:tail:tail.0] inode=92276569 handle rotation(): /test.log => /test.2025-11-08.0.log
[2025/11/08 16:15:32.65803710] [ info] [input:tail:tail.0] inotify_fs_remove(): inode=92276569 watch_fd=1
[2025/11/08 16:15:32.65896291] [ info] [input:tail:tail.0] inotify_fs_add(): inode=92276569 watch_fd=2 name=/test.2025-11-08.0.log
[2025/11/08 16:15:32.66060215] [ info] [input:tail:tail.0] inotify_fs_add(): inode=92276570 watch_fd=3 name=/test.log
[2025/11/08 16:16:32.415373474] [ info] [input:tail:tail.0] inotify_fs_remove(): inode=92276569 watch_fd=2
[2025/11/08 16:16:33.359858992] [ info] [input:tail:tail.0] inotify_fs_add(): inode=92276569 watch_fd=4 name=/test.2025-11-08.0.log
At this point, Fluent Bit re-reads the rotated file (test.2025-11-08.0.log) even though it already has a DB record for that same path and inode.
From /fluent-bit/db/test.db (in_tail_files table):
1|/test.2025-11-08.0.log|209718068|92276569|1762618237|1
2|/test.log|40541711|92276570|1762618532|0
3|/test.2025-11-08.0.log|209718068|92276569|1762618592|0
Row #1 already marked rotated=1, but row #3 reappears for the same inode/path, and Fluent Bit starts reading it again.