[Windows] fluent-bit keep deleted files

[farcop]

Environment:
Windows Server 2016 Stardard
Fluent Bit v1.4.2 started with winsw wrapper

Input configuration:

[INPUT]
    Name    tail
    Parser  eventlog
    Path    D:\temp\events.log
    DB      D:\td-agent-bit\conf\event_1.db

As is:
If we'll try to delete file D:\temp\events.log for example with Powershell
Remove-Item -Force -LiteralPath D:\temp\events.log
or with Shift+Del hotkeys, then file marked DeletePending: True, but file does not actually get removed from the file system.
Anybody that tries to open the file after that gets an Access denied error.
Fluent-bit continues to query information about file and nothing writes to log.
After Fluent-bit stops file D:\temp\events.log deletes from file system.

As expected:
After file was marked DeletePending: True, fluent-bit release it and give a chance to delete file from file system.

[kaay-it]

I have the same issue.

[fujimotos]

Fluent-bit continues to query information about file and nothing writes to log.
After Fluent-bit stops file D:\temp\events.log deletes from file system.

@farcop Hmm. I spent some time this evening trying to reproduce your
issue, but failed.

AFAICT when we remove a file on NTFS, Windows actually moves the file
to C:$extend\$deleted. So Fluent Bit must detect the file removal
(as a "file rotation" event), and subsequently close the handler.

In fact, I could perform "delete & create" operation to a file being
watched by Fluent Bit without any problem.

% del test.log
% echo aiueo > test.log

... That being said, while I'm unable to reproduce the issue myself,
I prepared a patch #2141 that I think would solve your issue .

This adds an explicit check for DeletePending to tail_fs_check()
that should shieve any file waiting for removal promptly.

I'd appreciate if you could test this patch and see if it solves your problem.

[farcop]

@fujimotos patched files from this build https://ci.appveyor.com/project/fluent/fluent-bit-2e87g/build/job/y2vhal6w4lwsdddi/artifacts
So its works now as expected.

Fluent-bit was started and works for a while

...
[2020/04/30 17:14:27] [debug] [input:tail:tail.0] file=D:\temp\events.log promote to TAIL_EVENT

del events.log

[2020/04/30 17:14:38] [debug] [input:tail:tail.0] file is to be delete: D:\temp\events.log
[2020/04/30 17:14:38] [debug] [input:tail:tail.0] db: file deleted from database: D:\temp\events.log

echo aiueo > events.log

[2020/04/30 17:15:25] [debug] [input:tail:tail.0] add to scan queue D:\temp\events.log, offset=0
[2020/04/30 17:15:25] [debug] [input:tail:tail.0] 1 new files found for 'D:\temp\events.log'
[2020/04/30 17:15:25] [debug] [input:tail:tail.0] file=D:\temp\events.log read=16 lines=1
[2020/04/30 17:15:25] [debug] [input:tail:tail.0] file=D:\temp\events.log promote to TAIL_EVENT

Thank you so much!

[edsiper]

fixed in #2141

[andrerca]

Hello,

i'm with the same error when fluent-bit 2.1.2 is in different server, reading *.json files from an network share, on Windows.
File is marked for deletion by log rotate, but it will remain in system if fluent-bit is still running, no matter how old the file is.