Clarify rotation expectation for containerd logs in filelogreciever

[brandonbirdj]

Component(s)

receiver/filelog

Describe the issue you're reporting

The example in container parser has an include of .../*.log which matches the kubernetes example.

I am using containerd, and the log names that kubelet creates are as follows.

drwxr-xr-x    2 root     root        4.0K Oct 10 13:24 .
drwxr-xr-x    9 root     root        4.0K Oct 10 00:51 ..
-rw-r-----    1 root     root        7.8M Oct 10 18:40 0.log
-rw-r--r--    1 root     root        2.8M Oct 10 13:24 0.log.20241010-132407.gz (oldest)
-rw-r--r--    1 root     root        2.9M Oct 10 13:24 0.log.20241010-132417.gz
-rw-r--r--    1 root     root        3.1M Oct 10 13:24 0.log.20241010-132428.gz
-rw-r-----    1 root     root       36.5M Oct 10 13:24 0.log.20241010-132438 (recently rotated, not yet zipped)

Do I need to include the 0.log.20241010-132438 file in the filelog include section? It seems to follow the log when it's rotated, but I'm having a small loss of logs and I think it might be having an issue since the new name is not in includes. According to otelcol_fileconsumer_reading_files metric there are many files being read at a time so I think not including it is correct.

It's very difficult to tell from the documentation what is the correct action here to include or not though so I was hoping you might help clarify it for me.

If it should be included this is the config.

receivers:
  filelog:
    include:
    - /var/log/pods/*/*/*.log
    - /var/log/pods/*/*/*.log.*
    exclude:
    # Exclude zipped logs so we don't double ship them
    - /var/log/pods/*/*/*.gz
    # The .tmp log only appears briefly during rotation as part of the zipping process
    - /var/log/pods/*/*/*.tmp

[github-actions]

Pinging code owners:

• receiver/filelog: @djaglowski

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[djaglowski]

You can read about how the receiver is designed to handle log rotation here. In short, it tries to make no assumptions except that files are append-only.

[brandonbirdj]

You can read about how the receiver is designed to handle log rotation here. In short, it tries to make no assumptions except that files are append-only.

Thank you @djaglowski I was confused because the debug logs would always show the original log name, I had thought it might change to the rotated name, that was a bad assumption. Indeed it is working as expected and my problem ended up being CPU throttling.

[djaglowski]

I was confused because the debug logs would always show the original log name, I had thought it might change to the rotated name, that was a bad assumption.

Seems like a reasonable assumption to me and something we could likely fix.