Log rotation on Windows

[fullMetalFileCabinet]

Relevant telegraf.conf:

## Logging configuration:
  ## Run telegraf with debug log messages.
  debug = false
  ## Run telegraf in quiet mode (error log messages only).
  quiet = false
  ## Specify the log file name. The empty string means to log to stderr.
  logfile = "/Program Files/Telegraf/telegraf.log"

  ## The logfile will be rotated after the time interval specified.  When set
  ## to 0 no time based rotation is performed.
  logfile_rotation_interval = "1d"

  ## The logfile will be rotated when it becomes larger than the specified
  ## size.  When set to 0 no size based rotation is performed.
  # logfile_rotation_max_size = "0MB"

  ## Maximum number of rotated archives to keep, any older logs are deleted.
  ## If set to -1, no archives are removed.
  logfile_rotation_max_archives = 5 

  ## Override default hostname, if empty use os.Hostname()
  hostname = ""
  ## If set to true, do no set the "host" tag in the telegraf agent.
  omit_hostname = false

System info:

telegraf-1.11.1_windows_amd64

Windows Server 2016 Standard

Steps to reproduce:

1. Configure telegraf.conf with log settings from above, logfile_rotation_interval = "1d"
2. Restart Telegraf service (Telegraf is running as Windows service)

Expected behavior:

Log file rotation after 1 day, or 24 hours.

Actual behavior:

No log file rotation occurs.

Additional info:

Seems to have possibly been addressed here:

#3393

I've also tried the argument as, logfile_rotation_interval = "24h", as well as trying to rotate based on size, logfile_rotation_max_size = "1KB", neither seem to work.

[danielnelson]

As a test, does it work with a much smaller interval such as "5m"?

[fullMetalFileCabinet]

Changing the setting to "5m" made no difference by itself. However, changing the setting to "5m" AND changing debug to 'debug = true' (so something would be written) did result in log file rotation.

Is it possible that it is only checking the log file timestamp/size when it writes something to it?

In our environment the only time I see things written to the log is during a service restart, or when we drop connection to the metrics/graphite system. The latter was my primary concern, and why I started looking at rotation.

Log example when service is restarted:

2019-07-30T18:03:36Z I! [agent] Hang on, flushing any cached metrics before shutdown
2019-07-30T18:03:38Z I! Loaded inputs: win_perf_counters
2019-07-30T18:03:38Z I! Loaded aggregators:
2019-07-30T18:03:38Z I! Loaded processors:
2019-07-30T18:03:38Z I! Loaded outputs: graphite
2019-07-30T18:03:38Z I! Tags enabled: host=x-dev
2019-07-30T18:03:38Z I! [agent] Config: Interval:30s, Quiet:false, Hostname:"x-dev", Flush Interval:40s

Log example when we drop connection to our metrics server:

2019-07-01T18:48:28Z E! Graphite: Reconnecting and retrying:
2019-07-01T18:48:28Z E! Error writing to output [graphite]: Could not write to any Graphite server in cluster

[danielnelson]

Is it possible that it is only checking the log file timestamp/size when it writes something to it?

Yes, no writes means no rotation. I think this is okay behavior though a bit confusing.

[fullMetalFileCabinet]

Yes, it makes sense when rotation is based on size, but not so much when based on time. At a minimum, having something in the comments may be helpful. I'm more on the operations side, so not really sure what the "right" answer is here...

[danielnelson]

That's a good point about size vs time, I've added a note to the time based rotation option that will hopefully reduce future confusion. 28f1bdb

[donalod]

Still an issue #6888 (comment)