FKM reading file from the beginning
Related to Copied
Old FKM alerts, unexpected FKM alerts, FKM reading file from beginning, FKM re-reading file, alerts on accepted triggers, FKM reading file from the start
Problem Copied
The user notices that the FKM plug-in is reading a file from the beginning and alerting on previously reported triggers.
Possible Cause(s) Copied
Root Cause 1 - the Rewind option is ticked (disabled by default) on the FKM sampler. This will cause the FKM plugin to read the file from the beginning under the following conditions:
- A change is made to the FKM sampler configuration
- The Gateway or Netprobe is restarted
In general the FKM Rewind option should not be changed from the default, except during the development of new sampler configurations or for diagnostics.
Root Cause 2 - If the file path contains wildcards (’*’ and ‘?’) and the Wildcard Monitor All Matches setting is disabled (by default), the FKM plug-in will read the file from the beginning whenever it detects the file is new, specifically if the file’s inode (File ID in Windows) changes, regardless of the rewind setting.
This can have an unwanted effect when the wildcarded file path picks up two matching files that are being written to by external applications. The newest file may flip-flop every sample and its entire contents may be re-read each time.
For example, the below FKM sampler is monitoring the following file path: /export/home/mmuniz/FKM_TEST_FOLDER/application*.log
Notice both the Rewind and Wildcard monitor all matches settings are disabled.
Below is an example of the resulting dataview. Notice the following:
- The first two highlighted entries picked up at 11:13:02 are for application_1.log.
- Following that, the FKM plug-in picks up keys from the application_2.log at 11:42:42.
- Then, at 11:15:42 we see the FKM plug-in treats the application_1.log file as a new file, and re-reads it from the beginning and alerts on the new and previously alerted log file entries.
Possible Solution(s) Copied
Solution Root Cause 1 - When the rewind option is un-ticked (by default), the FKM plug-in reads the file from the end on start-up.
Solution Root Cause 2 (1) - Enable the Wildcard monitor all matches setting under the FKM advanced tab at the bottom of the sampler record.
This will create a separate entry for each filename in the FKM sampler and avoid repeat alerts as seen below:
Solution Root Cause 2 (2) - In addition to the above solution, if you do not want to see one of the files listed by the FKM dataview, you can move the file to another directory.