[jira] [Created] (NIFI-4205) TailFile can produce duplicated data when it wrongly assumes a file is rotated

["Koji Kawamura (JIRA)" <ji...@apache.org>]

Koji Kawamura created NIFI-4205:
-----------------------------------

             Summary: TailFile can produce duplicated data when it wrongly assumes a file is rotated
                 Key: NIFI-4205
                 URL: https://issues.apache.org/jira/browse/NIFI-4205
             Project: Apache NiFi
          Issue Type: Bug
          Components: Extensions
    Affects Versions: 1.1.0
            Reporter: Koji Kawamura


TailFile checks whether a file being tailed is rotated by following lines of code, and if it determines so, it resets the reader and state for the file:
https://github.com/apache/nifi/blob/master/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/TailFile.java#L693
{code}
        // Check if file has rotated
        if (rolloverOccurred
                || (timestamp <= file.lastModified() && length > file.length())
                || (timestamp < file.lastModified() && length >= file.length())) {

            // Since file has rotated, we close the reader, create a new one, and then reset our state.
            try {
                reader.close();
                getLogger().debug("Closed FileChannel {}", new Object[]{reader, reader});
            } catch (final IOException ioe) {
                getLogger().warn("Failed to close reader for {} due to {}", new Object[]{file, ioe});
            }

            reader = createReader(file, 0L);
            position = 0L;
            checksum.reset();
        }
{code}

The third condition, newer timestamp but the same file size can work negatively in some situations. For example:

# If an already fully tailed file is 'touched' and last modified timestamp is updated. This is the easiest way to produce duplicated content.
# On Windows, if a file is being tailed and updated by an app that writes logs or some data to it consistently and frequently, then the last modified timestamp can be delayed to be updated compared to file size. I couldn't find canonical docs for this behavior, but testing on Windows consistently produces duplicated data. And the 3rd condition becomes true when such duplication occurs.

TailFile updates the file timestamp and length when it reads some data from the file, specifically at these lines:
https://github.com/apache/nifi/blob/master/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/TailFile.java#L765
{code}
            timestamp = Math.max(state.getTimestamp(), file.lastModified());
            length = file.length();
{code}

As mentioned at the 2nd case above, file.lastModified returns stale timestamp (or maybe just not being flushed yet) while length is replaced by the latest value. Once this happens, at the next onTrigger cycle, the 3rd condition becomes true because it detects newer timestamp.

These conditions are added by NIFI-1170 and NIFI-1959.

A simple flow, TailFile -> SplitText -> (FlowFiles are queued) -> UpdateAttribute(Stopped) can reproduce this, with a command-line to simulate frequently updated log file:
{code}
$ for i in `seq 1 10000`; do echo $i >> test.log; done
{code}
The expected result is having generated FlowFiles queued at the relationship between SplitText and UpdateAttribute. But on Windows, more FlowFiles are generated.

By enabling debug level log for TailFile, following log messages can be confirmed:
{code}
Add this to conf/logback.xml
<logger name="org.apache.nifi.processors.standard.TailFile" level="DEBUG"/>

2017-07-19 10:22:07,134 DEBUG [Timer-Driven Process Thread-3] o.a.nifi.processors.standard.TailFile TailFile[id=59ef6ea7-0
15d-1000-d6c2-c57a61e58a80] Recovering Rolled Off Files; total number of files rolled off = 0
2017-07-19 10:22:07,134 DEBUG [Timer-Driven Process Thread-3] o.a.nifi.processors.standard.TailFile TailFile[id=59ef6ea7-015d-1000-d6c2-c57a61e58a80] Closed FileChannel sun.nio.ch.FileChannelImpl@6d2a1eaf
2017-07-19 10:22:07,134 DEBUG [Timer-Driven Process Thread-3] o.a.nifi.processors.standard.TailFile TailFile[id=59ef6ea7-015d-1000-d6c2-c57a61e58a80] Created FileChannel sun.nio.ch.FileChannelImpl@4aefddb3 for C:\logs\test.log
2017-07-19 10:22:07,150 DEBUG [Timer-Driven Process Thread-3] o.a.nifi.processors.standard.TailFile TailFile[id=59ef6ea7-015d-1000-d6c2-c57a61e58a80] Reading lines starting at position 0
{code}

The 3rd condition should be removed to avoid having these duplicated data ingested. Or if there's any specific need, we should discuss about it and implement additional solution.

Optionally, the 2nd condition should be included in the 'rolloverOccurred' flag to make it more readable.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)