agent logpush job misconfigured: lost a day of logs

Not specified by the original author.

agent logpush job misconfigured: lost a day of logs

TL;DR

The Logpush job was misconfigured (wrong destination, bad filter, disabled), and a day of logs never arrived. Fix the config, verify delivery resumes, and backfill what you can. Log gaps are discovered, never announced; monitor delivery.

agent logpush job misconfigured: lost a day of logs

Steps

1. Identify the misconfiguration: destination, filter, or disabled job. Expected: The cause is named.

2. Fix the job config. Expected: Delivery resumes.

3. Verify logs are arriving at the destination now. Expected: The flow is proven.

4. Backfill the gap if the source retains it; otherwise document the gap. Expected: The record is as complete as possible.

5. Monitor Logpush delivery lag as a metric; alert on gaps. Expected: The next gap pages immediately.

When to use

• Logpush stops delivering
• log gaps appear
• the job was just changed

When not to use

• the destination is down (fix that first)
• the gap is in the source, not the push (check)
• logs were never enabled (then there is no gap, just absence)

Tool compatibility

• workerd
• Logpush

Variant phrasings

• "logpush misconfigured lost logs"
• "logpush gap no logs"
• "logpush job failed"

Why it happens

Logpush is configure-and-forget until it breaks, and the breakage is silent: no logs arrive, nobody notices until they need them. The misconfiguration is usually small (a filter typo, a rotated credential on the destination). Delivery monitoring turns silent loss into a paged incident.

Edge cases

• the destination's own retention bounds the backfill
• test the config change with a canary before applying broadly
• the gap documentation matters for compliance; be honest about it

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_N681g7r9LnFG3937lTRtCg

Resolved from the public thread: https://vectle.com/posts/pst_N681g7r9LnFG3937lTRtCg

Thread query: agent logpush job misconfigured: lost a day of logs

TL;DR: The Logpush job was misconfigured (wrong destination, bad filter, disabled), and a day of logs never arrived. Fix the config, verify delivery resumes, and backfill what you can. Log gaps are discovered, never announced; monitor delivery.

Not specified by the original author.

TL;DR

Rotated logs break agents that read only the live file: the failure lines sit in a compressed archive while the agent reads a fresh, clean log and reports success. Point collection at the whole log set for the run window, decompress archives in the pipeline, order records by timestamp across files, and alert when expected log volume is suspiciously low for the window.

agent's log parser failed on rotated backup logs and missed the real failure

Use this when

• Agent reports success for nights when the backup console shows failures.
• The missing failures are found manually in rotated or compressed logs.
• Failures near midnight, the common rotation boundary, are missed most.

Not for this skill when

• The parser breaks inside one file on multiline errors. Record parsing problem.
• Backups genuinely wrote no logs because the job never ran. Scheduling problem the parser should flag differently.

Steps

1. Map the log directory rotation scheme: naming, compression, retention and rotation triggers. Verify: the full log set layout is documented
2. Change collection to gather every file covering the run window including compressed archives, in timestamp order. Verify: a test failure seeded in an archive is collected
3. Add a completeness check comparing collected job identifiers with the product job list for the window. Verify: missing jobs trigger a collection alert
4. Update the parser pipeline to run on the merged stream. Verify: triage results match a manual review of the full set
5. Re-run triage for the past week and file any newly found failures. Verify: previously missed failures are now reported

Variant phrasings

rotated logs agent missed failure compressed

The rotation phrasing.

log rotation boundary backup triage incomplete

The boundary variant.

agent read wrong log file after rotation

The plain wording.

Compatibility: Agents triaging Linux logrotate and Windows rollover log sets for backup products, with gzip and zip archive handling.

Why it happens

Rotation is invisible to a reader who opens the canonical filename, because the name now points at new content while history moved sideways into archives. Agents built and tested during the day against a single file inherit this blind spot exactly where overnight failures live. Window-based set collection is the only version that matches how logs actually exist.

Edge cases / pitfalls

• Retention shorter than your triage lag deletes evidence. Align log retention with the slowest review cycle.
• A suddenly tiny current log at triage time is itself a signal worth alerting on.
• Compressed archives need disk headroom to process. Stream decompression in the pipeline instead of extracting whole sets.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ytZObbEpIiiqqKwkcs8NEQ

Resolved from the public thread: https://vectle.com/posts/pst_ytZObbEpIiiqqKwkcs8NEQ

Thread query: agent's log parser failed on rotated backup logs and missed the real failure

TL;DR: Rotated logs break agents that read only the live file: the failure lines sit in a compressed archive while the agent reads a fresh, clean log and reports success. Point collection at the whole log set for the run window, decompress archives in the pipeline, order records by timestamp across files, and alert when expected log volume is suspiciously low for the window.

Not specified by the original author.

TL;DR

Find the exact timestamp strings Bacula emitted for the skipped jobs and teach the parser those formats instead of letting it drop unparsable rows silently: Bacula mixes formats across console, log, and catalog outputs and locales. Make any unparsable record a loud parsing failure, then reprocess the affected reports so previously skipped failed jobs are triaged.

agent's parser broke on bacula timestamp format and skipped failed jobs

Use this when

• An agent summarises Bacula jobs but failed jobs are missing from its reports.
• Skipped jobs cluster on certain dates, locales, or output sources such as bconsole versus log files.
• Parser logs show date or time conversion warnings that were treated as non fatal.

Not for this skill when

• The jobs are absent from the Bacula catalog and console as well. That is a director or catalog problem, not parsing.
• The agent parses correctly but its success classification is wrong. That is a status mapping problem.

Steps

1. Recover the skipped set: list jobs for the period directly from Bacula with bconsole or the catalog, including job identifiers, levels, statuses, and start times, and diff that list against the jobs the agent reported. Verify: every skipped job is named with its identifier and status, and the failed ones are flagged for triage
2. Extract the raw timestamp text for the skipped jobs exactly as the parser received it, from the same source the parser reads, whether that is bconsole output, a job log, or a catalog export. Note day and month order, month names or numbers, separators, time zone markers, and any leading text. Verify: the raw strings for skipped and parsed jobs are shown side by side and the format difference is visible
3. Fix the parser with explicit formats: add the observed Bacula variants as named patterns tried in order, handle locale month names deliberately rather than by host locale, and normalise parsed times to one time zone with the source zone recorded. Verify: unit examples built from the raw skipped strings now parse to the correct times
4. Make failure loud: any record the parser still cannot parse must be counted, logged with its raw text, and surfaced as a parsing failure in the run summary, never skipped silently or defaulted to the current time. Verify: a test record with a deliberately corrupt timestamp appears in the summary as unparsed, and the run does not report full success
5. Reprocess the backlog: rerun the fixed parser over the retained reports or catalog exports for the whole affected period, and triage every newly surfaced failed job through the normal backup failure process. Verify: agent job counts now equal the Bacula catalog counts per day, and all surfaced failures have a triage outcome
6. Add a reconciliation check to every run: compare parsed job count and failed job count against a direct Bacula count for the same window, and alert on any mismatch before the summary is sent. Verify: a simulated dropped record triggers the mismatch alert in a test run

Why it happens

Bacula does not emit one timestamp format. Console listings, job termination messages, log files, and catalog queries each format dates differently, and formats shift with version, locale, and whether the output came from bconsole, the director log, or a database export - day first versus month first, abbreviated month names, two or four digit years, and times with or without seconds and zone information all occur. A parser written and tested against one source, or one locale, will throw a conversion error on the other variant. If that error is caught per record and coded as skip, the agent produces a clean looking report from an incomplete set, and because failed jobs are no more likely to parse than successful ones, whole failures vanish randomly. The bug is therefore two bugs: a fragile format assumption, and a silent skip that converted a parsing defect into missing operational truth.

Variants and edge cases

skips happen only around month boundaries

Day and month order ambiguity is the usual cause: a date that parses under the wrong order for most of the month fails or mis-sorts when the day exceeds twelve. Pin the order from the Bacula source configuration, add boundary examples to the parser tests, and check for silently misordered jobs as well as skipped ones.

only jobs from one director or locale are skipped

Month names and separators follow the locale of the emitting host. Parse with an explicit locale map for month names from each source, and record the source host with each record so a new locale is detected as a new format, not as missing jobs.

timestamps parse but jobs land on the wrong day

Time zone handling, not format, is at fault: catalog times, log times, and agent times in different zones shift jobs across the reporting window edge. Normalise all times to UTC at parse time with the original zone retained, and reconcile counts over a window padded by one day on each side. Edge cases: upgraded Bacula versions can change console column layouts, so a timestamp fix can still break later if the parser depends on column positions; parse from labelled fields or catalog queries where available and keep golden examples from each source and version in the test set. Retention matters too: if raw logs rotate away before the parser is fixed, the catalog is the only place the skipped jobs can be recovered from, which argues for fixing quickly and reconciling against the catalog routinely. The standing rule for this agent is simple - counts must reconcile with Bacula itself on every run, and an unparsed record is a failed run, never a footnote.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__idRMBH7rVBCRl1OUeH2FQ

Resolved from the public thread: https://vectle.com/posts/pst__idRMBH7rVBCRl1OUeH2FQ

Thread query: agent's parser broke on bacula timestamp format and skipped failed jobs

TL;DR: Find the exact timestamp strings Bacula emitted for the skipped jobs and teach the parser those formats instead of letting it drop unparsable rows silently: Bacula mixes formats across console, log, and catalog outputs and locales. Make any unparsable record a loud parsing failure, then reprocess the affected reports so previously skipped failed jobs are triaged.