User Profile
svangimalla
Copper Contributor
Joined 11 months ago
User Widgets
Recent Discussions
log collector fails to upload Fortinet logs | MCAS
Messages under "/var/adallom/syslog/rotated/514/" fails to be uploaded. Added error log below. It says message files are locked and files are not uploaded. Posting here for expert advice. Thanks in advance! Log collector status: General information: Files uploaded: 0 Status: OK Up since: 2024-01-30 08:04:00 Last configured: 2024-01-30 08:03:58 Last connected to portal: 2024-01-30 08:50:19 Disk use: Used 5%, available 344G/361G Data sources: Name: Forti_UDP Last log received: Not yet received Number of logs received: 8 Error Log: 2024-01-30 08:49:15.824 ERROR c.a.c.c.DirectoryMonitorFileProcessor DirectoryMonitorFileProcessor - messages-2024-01-30-35-1706603701 - Exception in DirectoryMonitorFileProcessor for file '/var/adallom/syslog/rotated/514/messages-2024-01-30-35-1706603701' java.lang.RuntimeException: Waiting too long for file to be unlocked at com.adallom.columbus.collectors.DirectoryMonitorFileProcessor.waitOnLockedFile(DirectoryMonitorFileProcessor.java:226) at com.adallom.columbus.collectors.DirectoryMonitorFileProcessor.internalRun(DirectoryMonitorFileProcessor.java:90) at com.adallom.columbus.utils.NamedRunnable.run(NamedRunnable.java:14) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:750) 2024-01-30 08:49:18.342 WARN o.a.h.c.p.ResponseProcessCookies DirectoryMonitor - /var/adallom/syslog/rotated - Invalid cookie header: "Set-Cookie: cas_sessionid=b35nyptc8li28xi7fumpo0d3azuto9ic; Domain=.us3.portal.cloudappsecurity.com; expires=Tue, 30 Jan 2024 09:49:18 GMT; HttpOnly; Max-Age=3600; Path=/; Secure". Invalid 'expires' attribute: Tue, 30 Jan 2024 09:49:18 GMT 2024-01-30 08:49:18.343 INFO c.a.c.collectors.DirectoryMonitor DirectoryMonitor - /var/adallom/syslog/rotated - Processing new file '/var/adallom/syslog/rotated/514/messages-2024-01-30-35-1706603701' 2024-01-30 08:49:18.913 WARN o.a.h.c.p.ResponseProcessCookies DirectoryMonitor - /var/adallom/ftp/discovery - Invalid cookie header: "Set-Cookie: cas_sessionid=tivwq8cem6txpmyhhxqbufyrc82b3oe9; Domain=.us3.portal.cloudappsecurity.com; expires=Tue, 30 Jan 2024 09:49:18 GMT; HttpOnly; Max-Age=3600; Path=/; Secure". Invalid 'expires' attribute: Tue, 30 Jan 2024 09:49:18 GMT 2024-01-30 08:49:26.106 WARN c.a.c.c.DirectoryMonitorFileProcessor DirectoryMonitorFileProcessor - messages-2024-01-30-15-1706602501 - Timeout waiting for lsof command on file '/var/adallom/syslog/rotated/514/messages-2024-01-30-15-1706602501', assuming it is locked Messages under Rotated directory: root@<>:/var/adallom/syslog/rotated/514# ls -lh total 8.5G -rw-r--r--. 1 root root 122 Jan 30 09:18 config.json -rw-r-----. 1 root adm 615M Jan 30 09:00 messages-2024-01-30-00-1706605201 -rw-r-----. 1 root adm 126M Jan 30 08:05 messages-2024-01-30-05-1706601901 -rw-r-----. 1 root adm 636M Jan 30 09:05 messages-2024-01-30-05-1706605501 -rw-r-----. 1 root adm 623M Jan 30 08:10 messages-2024-01-30-10-1706602201 -rw-r-----. 1 root adm 619M Jan 30 09:10 messages-2024-01-30-10-1706605801 -rw-r-----. 1 root adm 593M Jan 30 08:15 messages-2024-01-30-15-1706602501 -rw-r-----. 1 root adm 601M Jan 30 09:15 messages-2024-01-30-15-1706606101 -rw-r-----. 1 root adm 585M Jan 30 08:20 messages-2024-01-30-20-1706602801 -rw-r-----. 1 root adm 600M Jan 30 08:25 messages-2024-01-30-25-1706603101 -rw-r-----. 1 root adm 600M Jan 30 08:30 messages-2024-01-30-30-1706603402 -rw-r-----. 1 root adm 614M Jan 30 08:35 messages-2024-01-30-35-1706603701 -rw-r-----. 1 root adm 629M Jan 30 08:40 messages-2024-01-30-40-1706604001 -rw-r-----. 1 root adm 620M Jan 30 08:45 messages-2024-01-30-45-1706604301 -rw-r-----. 1 root adm 594M Jan 30 08:50 messages-2024-01-30-50-1706604601 -rw-r-----. 1 root adm 611M Jan 30 08:55 messages-2024-01-30-55-1706604901
