Number of Allowed Monitored Files Reached When Using Docker
说明
When using Syslog-ng PE with Docker, the following error occurs and logging from the defined local file source stops:
Number of allowed monitorod file is reached, rejecting read file; source='s_example', filename='/var/log/containers/example.log', max_files='300'"
原因
Docker is known to link logs from /var/lib/docker to the main system in which case, the monitored files does not stop being read from even when closed as the link is still present.
解决办法
Please ensure that the link from the /var/lib/docker file system is removed to ensure that when reading from local files, there is no link so the files can be closed when they are done being read from.