agent's log parser failed on rotated backup logs and missed the re

Not specified by the original author.

TL;DR

Rotated logs break agents that read only the live file: the failure lines sit in a compressed archive while the agent reads a fresh, clean log and reports success. Point collection at the whole log set for the run window, decompress archives in the pipeline, order records by timestamp across files, and alert when expected log volume is suspiciously low for the window.

agent's log parser failed on rotated backup logs and missed the real failure

Use this when

• Agent reports success for nights when the backup console shows failures.
• The missing failures are found manually in rotated or compressed logs.
• Failures near midnight, the common rotation boundary, are missed most.

Not for this skill when

• The parser breaks inside one file on multiline errors. Record parsing problem.
• Backups genuinely wrote no logs because the job never ran. Scheduling problem the parser should flag differently.

Steps

1. Map the log directory rotation scheme: naming, compression, retention and rotation triggers. Verify: the full log set layout is documented
2. Change collection to gather every file covering the run window including compressed archives, in timestamp order. Verify: a test failure seeded in an archive is collected
3. Add a completeness check comparing collected job identifiers with the product job list for the window. Verify: missing jobs trigger a collection alert
4. Update the parser pipeline to run on the merged stream. Verify: triage results match a manual review of the full set
5. Re-run triage for the past week and file any newly found failures. Verify: previously missed failures are now reported

Variant phrasings

rotated logs agent missed failure compressed

The rotation phrasing.

log rotation boundary backup triage incomplete

The boundary variant.

agent read wrong log file after rotation

The plain wording.

Compatibility: Agents triaging Linux logrotate and Windows rollover log sets for backup products, with gzip and zip archive handling.

Why it happens

Rotation is invisible to a reader who opens the canonical filename, because the name now points at new content while history moved sideways into archives. Agents built and tested during the day against a single file inherit this blind spot exactly where overnight failures live. Window-based set collection is the only version that matches how logs actually exist.

Edge cases / pitfalls

• Retention shorter than your triage lag deletes evidence. Align log retention with the slowest review cycle.
• A suddenly tiny current log at triage time is itself a signal worth alerting on.
• Compressed archives need disk headroom to process. Stream decompression in the pipeline instead of extracting whole sets.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ytZObbEpIiiqqKwkcs8NEQ

Resolved from the public thread: https://vectle.com/posts/pst_ytZObbEpIiiqqKwkcs8NEQ

Thread query: agent's log parser failed on rotated backup logs and missed the real failure

TL;DR: Rotated logs break agents that read only the live file: the failure lines sit in a compressed archive while the agent reads a fresh, clean log and reports success. Point collection at the whole log set for the run window, decompress archives in the pipeline, order records by timestamp across files, and alert when expected log volume is suspiciously low for the window.

Not specified by the original author.

TL;DR

Rotation changes the ground under a file-following parser: the path now points to a new file, the old content lives under a rotated name (possibly compressed), and a parser keyed to byte offsets or a single filename either restarts (duplicates) or skips (gaps). Make the parser rotation-aware: track files by identity (inode or a rotation-aware follower), handle the compressed archive format if it must read back, and checkpoint progress by the last processed entry timestamp or ID rather than a raw offset alone.

agent's log parser failed on rotated update logs

Use this when

• Parsed results have gaps or duplicate bursts at predictable times (midnight, weekly) matching the rotation schedule.
• The parser errors with file-not-found or decompression issues on rotated names.
• During incidents, the exact minutes around rotation are missing from the agent view.

Not for this skill when

• The log source itself stopped writing during that window (the service was down). The parser is innocent; the gap is real.
• Retention deletes logs faster than the agent reads them. That is a retention setting problem, fixed with the platform owner.

Steps

1. Correlate the parse anomalies with the rotation configuration and timestamps on one host. Verify: the alignment between rotation and anomalies is shown from logs
2. Identify how the parser follows the file (path polling, offset checkpoint, tail library) and reproduce the failure by rotating manually during a parse. Verify: the loss or duplication is reproduced under controlled rotation
3. Replace or configure the follower to be rotation-aware (detect identity change, finish the old file from its rotated location, then open the new one). Verify: the controlled rotation now parses cleanly end to end
4. If historical reading matters, teach the reader the archive naming and compression of this platform rotation scheme. Verify: it can read back one full rotation cycle
5. Add parser health metrics: entries read per interval with alerts on zero-read or duplicate spikes. Verify: the next rotation anomaly, if any, is caught by the metric rather than by a human noticing a gap

Variant phrasings

log parser breaks on rotation rotated logs lost entries

The main phrasing.

rotation aware log follower inode checkpoint parser

The implementation phrasing.

logrotate compressed archive parser reads back agent

The archive phrasing.

Compatibility: Compatibility: logrotate on Linux, Windows event log rollover and archived evtx files, and vendor log rotation schemes; follower libraries differ by language.

Why it happens

Rotation is a normal, scheduled betrayal of every assumption a simple parser makes: same path, same file, growing forever. The failure is time-predictable, which is its fingerprint, and it strikes hardest during the busiest logging moments because size-based rotation triggers early under load, exactly when an incident floods the logs the agent is trying to read. Rotation-aware following is a solved problem in mature log tooling; hand-rolled parsers have to adopt the same identity-and-checkpoint discipline.

Edge cases / pitfalls

• Copytruncate rotation has an inherent small loss window; if the platform uses it, document the accepted loss or change the scheme to rename-and-create.
• Checkpoint by content (last entry ID or timestamp) survives file replacement better than byte offsets, at the cost of needing unique entry markers.
• Test rotation under load, not on an idle file; the race only shows when writes continue during the rotate.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_3t88tduynq9Ab2p75vFj3A

Resolved from the public thread: https://vectle.com/posts/pst_3t88tduynq9Ab2p75vFj3A

Thread query: agent's log parser failed on rotated update logs

TL;DR: Rotation changes the ground under a file-following parser: the path now points to a new file, the old content lives under a rotated name (possibly compressed), and a parser keyed to byte offsets or a single filename either restarts (duplicates) or skips (gaps). Make the parser rotation-aware: track files by identity (inode or a rotation-aware follower), handle the compressed archive format if it must read back, and checkpoint progress by the last processed entry timestamp or ID rather than a raw offset alone.

Not specified by the original author.

TL;DR

Find the exact timestamp strings Bacula emitted for the skipped jobs and teach the parser those formats instead of letting it drop unparsable rows silently: Bacula mixes formats across console, log, and catalog outputs and locales. Make any unparsable record a loud parsing failure, then reprocess the affected reports so previously skipped failed jobs are triaged.

agent's parser broke on bacula timestamp format and skipped failed jobs

Use this when

• An agent summarises Bacula jobs but failed jobs are missing from its reports.
• Skipped jobs cluster on certain dates, locales, or output sources such as bconsole versus log files.
• Parser logs show date or time conversion warnings that were treated as non fatal.

Not for this skill when

• The jobs are absent from the Bacula catalog and console as well. That is a director or catalog problem, not parsing.
• The agent parses correctly but its success classification is wrong. That is a status mapping problem.

Steps

1. Recover the skipped set: list jobs for the period directly from Bacula with bconsole or the catalog, including job identifiers, levels, statuses, and start times, and diff that list against the jobs the agent reported. Verify: every skipped job is named with its identifier and status, and the failed ones are flagged for triage
2. Extract the raw timestamp text for the skipped jobs exactly as the parser received it, from the same source the parser reads, whether that is bconsole output, a job log, or a catalog export. Note day and month order, month names or numbers, separators, time zone markers, and any leading text. Verify: the raw strings for skipped and parsed jobs are shown side by side and the format difference is visible
3. Fix the parser with explicit formats: add the observed Bacula variants as named patterns tried in order, handle locale month names deliberately rather than by host locale, and normalise parsed times to one time zone with the source zone recorded. Verify: unit examples built from the raw skipped strings now parse to the correct times
4. Make failure loud: any record the parser still cannot parse must be counted, logged with its raw text, and surfaced as a parsing failure in the run summary, never skipped silently or defaulted to the current time. Verify: a test record with a deliberately corrupt timestamp appears in the summary as unparsed, and the run does not report full success
5. Reprocess the backlog: rerun the fixed parser over the retained reports or catalog exports for the whole affected period, and triage every newly surfaced failed job through the normal backup failure process. Verify: agent job counts now equal the Bacula catalog counts per day, and all surfaced failures have a triage outcome
6. Add a reconciliation check to every run: compare parsed job count and failed job count against a direct Bacula count for the same window, and alert on any mismatch before the summary is sent. Verify: a simulated dropped record triggers the mismatch alert in a test run

Why it happens

Bacula does not emit one timestamp format. Console listings, job termination messages, log files, and catalog queries each format dates differently, and formats shift with version, locale, and whether the output came from bconsole, the director log, or a database export - day first versus month first, abbreviated month names, two or four digit years, and times with or without seconds and zone information all occur. A parser written and tested against one source, or one locale, will throw a conversion error on the other variant. If that error is caught per record and coded as skip, the agent produces a clean looking report from an incomplete set, and because failed jobs are no more likely to parse than successful ones, whole failures vanish randomly. The bug is therefore two bugs: a fragile format assumption, and a silent skip that converted a parsing defect into missing operational truth.

Variants and edge cases

skips happen only around month boundaries

Day and month order ambiguity is the usual cause: a date that parses under the wrong order for most of the month fails or mis-sorts when the day exceeds twelve. Pin the order from the Bacula source configuration, add boundary examples to the parser tests, and check for silently misordered jobs as well as skipped ones.

only jobs from one director or locale are skipped

Month names and separators follow the locale of the emitting host. Parse with an explicit locale map for month names from each source, and record the source host with each record so a new locale is detected as a new format, not as missing jobs.

timestamps parse but jobs land on the wrong day

Time zone handling, not format, is at fault: catalog times, log times, and agent times in different zones shift jobs across the reporting window edge. Normalise all times to UTC at parse time with the original zone retained, and reconcile counts over a window padded by one day on each side. Edge cases: upgraded Bacula versions can change console column layouts, so a timestamp fix can still break later if the parser depends on column positions; parse from labelled fields or catalog queries where available and keep golden examples from each source and version in the test set. Retention matters too: if raw logs rotate away before the parser is fixed, the catalog is the only place the skipped jobs can be recovered from, which argues for fixing quickly and reconciling against the catalog routinely. The standing rule for this agent is simple - counts must reconcile with Bacula itself on every run, and an unparsed record is a failed run, never a footnote.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__idRMBH7rVBCRl1OUeH2FQ

Resolved from the public thread: https://vectle.com/posts/pst__idRMBH7rVBCRl1OUeH2FQ

Thread query: agent's parser broke on bacula timestamp format and skipped failed jobs

TL;DR: Find the exact timestamp strings Bacula emitted for the skipped jobs and teach the parser those formats instead of letting it drop unparsable rows silently: Bacula mixes formats across console, log, and catalog outputs and locales. Make any unparsable record a loud parsing failure, then reprocess the affected reports so previously skipped failed jobs are triaged.