-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adding a Debug reader to detect Null Bytes from the io.Reader #9210
Conversation
@urso This is briefly what we discussed yesterday about null-bytes over network volume or the issue that we are still investigating at https://discuss.elastic.co/t/filbeat-still-ooms/156211/25 It should be pretty low impact even in production, if we detect too much null-bytes the reader will just disable itself. But in the log at info level we will see that we have matched some bytes + surrounding data. QuestionsShould we log it at info level or should we enforce a special selector? |
6377408
to
009e940
Compare
Error is legit under windows, looking into it. |
65ad07f
to
452fa40
Compare
@urso I think I have addressed all the issues in the PR, the |
@urso updated with the latest comments. |
Oh windows, I presume I am not correctly writing the null bytes on windows. |
LGTM |
When you are reading logs on a network volume like NFS or ZFS it is possible that the underlying filesystem return null bytes instead of returning concrete data, its not currently possible to detect that in all scenario unless events are eventually send to ES and you can inspect them and see \u0000 chars in the messages. This is a small proposal to add a Debug Reader which should only by used for debugging purpose it allow to log if any null bytes are present in the streams of bytes and will log surround values. It accepts an io.Reader as the source of data, a buffer size, a predicate to check the value of a byte and how much detection invokation it should do before disabling the check. Enable it with either of the following selectors: "*" or "detect_null_bytes"
3449f3f
to
253ff2a
Compare
I've fixed the windows issue and rebase the content of this PR, when its green I will merge it. |
…c#9210) When you are reading logs on a network volume like NFS or ZFS it is possible that the underlying filesystem return null bytes instead of returning concrete data, its not currently possible to detect that in all scenario unless events are eventually send to ES and you can inspect them and see \u0000 chars in the messages. This is a small proposal to add a Debug Reader which should only by used for debugging purpose it allow to log if any null bytes are present in the streams of bytes and will log surround values. It accepts an io.Reader as the source of data, a buffer size, a predicate to check the value of a byte and how much detection invokation it should do before disabling the check. Enable it with either of the following selectors: "*" or "detect_null_bytes" (cherry picked from commit 96c924a)
…from the io.Reader (#9236) * Adding a Debug reader to detect Null Bytes from the io.Reader (#9210) When you are reading logs on a network volume like NFS or ZFS it is possible that the underlying filesystem return null bytes instead of returning concrete data, its not currently possible to detect that in all scenario unless events are eventually send to ES and you can inspect them and see \u0000 chars in the messages. This is a small proposal to add a Debug Reader which should only by used for debugging purpose it allow to log if any null bytes are present in the streams of bytes and will log surround values. It accepts an io.Reader as the source of data, a buffer size, a predicate to check the value of a byte and how much detection invokation it should do before disabling the check. Enable it with either of the following selectors: "*" or "detect_null_bytes" (cherry picked from commit 96c924a)
When you are reading logs on a network volume like NFS or ZFS it is
possible that the underlying filesystem return null bytes instead of
returning concrete data, its not currently possible to detect that in all
scenario unless events are eventually send to ES and you can inspect
them and see \u0000 chars in the messages.
This is a small proposal to add a Debug Reader which should only by used
for debugging purpose it allow to log if any null bytes are present in
the streams of bytes and will log surround values.
It accepts an io.Reader as the source of data, a buffer size, a
predicate to check the value of a byte and how much detection invokation it should do
before disabling the check.
Enable it with either of the following selectors: "*" or "detect_null_bytes"