Q&A Vector suddenly stopped monitoring files.

[EzLittleChen]

Question

Using a DaemonSet to collect service log files, the logs are continuously updated. However, Vector stops reading after a certain point in time, and the checkpoint remains stuck at that time.

ls -lati
total 1487556
 86443925 -rw-r--r-- 1  502  502 1483763471 Dec 23 16:58 app.log

grep 86443925 /var/lib/vector/k8s_file_logs/checkpoints.json
...{"fingerprint":{"dev_inode":[2064,86443925]},"position":5118608517,"modified":"2025-12-21T06:20:26.318649194Z"}...

Vector Config

sources:
    k8s_file_logs:
      type: file
      rotate_wait_secs: 600
      read_from: "end"
      max_line_bytes: 262144
      encoding:
        charset: utf-8
      fingerprint:
        strategy: device_and_inode
      ignore_not_found: true
      ignore_older_secs: 1800
      include:
        - /data1/kubernetes/logs/**/**/**/*.log

Vector Logs

2025-12-19T06:40:46.227255Z  INFO source{component_kind="source" component_id=k8s_file_logs component_type=file}:file_server: vector::internal_events::file::source: Found new file to watch. file=/data1/kubernetes/logs/eeo/eeocn-base/eeocn-base-6694c4569b-hjs7c/app.log

[EzLittleChen]

Since our service logs are not segmented, log cleanup will directly empty the file contents. Is this the reason?

[lhh528634141]

Since our service logs are not segmented, log cleanup will directly empty the file contents. Is this the reason?

me too,my config is as follows,and restart vector agent，it will be ok

sources:
      info:
        type: file
        include:
          - "/var/log/*/*/*/info.log"
        fingerprint:
          strategy: device_and_inode
        ignore_checkpoints: false
        read_from: end
        max_line_bytes: 4096000
        ignore_older_secs: 3600
        max_read_bytes: 8192
        rotate_wait_secs: 3600
        multiline:
          start_pattern: '^20\d{2}-\d{2}-\d{2}'
          mode: halt_before
          condition_pattern: '^20\d{2}-\d{2}-\d{2}'
          timeout_ms: 6000

[EzLittleChen]

When recording file fingerprints using the device_and_inode format, if the current file is cleared, the inode remains unchanged. The system will continue monitoring the file from the last read position. For example, if 100 lines have been read but the file is subsequently cleared, new logs written afterward start from the beginning. These logs will not be monitored until after the 100th line, meaning data prior to the 100th line will not be captured.

[lhh528634141]

When recording file fingerprints using the device_and_inode format, if the current file is cleared, the inode remains unchanged. The system will continue monitoring the file from the last read position. For example, if 100 lines have been read but the file is subsequently cleared, new logs written afterward start from the beginning. These logs will not be monitored until after the 100th line, meaning data prior to the 100th line will not be captured.

when occure following logs,the vector agent stop monitoring file，and rm -fr /vector-dir and restart vector agent，it will be okay

2026-01-05T10:13:59.305188266Z stderr F 2026-01-05T10:13:59.304867Z INFO source{component_kind="source" component_id=info component_type=file}:file_server: vector::internal_events::file::source: Resuming to watch file. file=/var/log/front-online/xx-mix-rest-paptrading/xx-mix-rest-paptrading-1/info.log file_position=1073742032