Does vector continue reading from rotated files if rotation happens while it's not running?

[precisionconage]

I see in the docs that vector continues reading until EOF for any files that rotate while it's running. But will it do this even if the file rotates while it's not running?

E.g. with this config,

sources:
  test_source:
    type: file
    exclude:
      - /var/log/*.[0-9]*.log
    include:
      - /var/log/*.log

what would happen in this scenario?

1. vector is started
2. File /var/log/application.log is created; vector starts tailing the file
3. vector is stopped
4. application.log fills up and is rotated to application.1.log
5. A new application.log is created
6. vector is started

Will vector read any logs that it missed from application.1.log on startup?

[jszwedko]

Hi @precisionconage ,

In this case, no, because the file is excluded from the scan patterns. If you want to continue reading the file if the file is rotated when Vector is stopped, you should remove the exclude block.

[precisionconage]

Thanks for the clarification @jszwedko! I figured I'd need the exclude part to avoid duplicate logs, but it looks like that would be handled already with fingerprinting.