Werk #19272: Text logfiles: New messages dropped silently when reaching limit for stored messages
| Component | Checks & agents | ||||||
| Title | Text logfiles: New messages dropped silently when reaching limit for stored messages | ||||||
| Date | Jan 28, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Bug Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
The Text logfiles check (mk_logwatch), when reaching the maximum file size for saved messages, dropped new log messages silently without any notification.
This led to a nonfunctional logfile monitoring that didn't process any new messages, and especially failed to detect WARN or CRIT patterns.
This is how it should have worked:
During the processing of log messages with mk_logwatch, relevant messages (depending on the logwatch configuration) are saved to a file on the monitoring server, and can be observed/acknowledged with the menu entry Open log under the service's action menu.
When this log file reaches the limit of 500 KB, mk_logwatch stops processing further messages, and the service shows the message Unacknowledged messages have exceeded max size, new messages are dropped, requiring the user to take action.
With this Werk, the maximum file size detection is functional again.
Please note that to resume monitoring you still must acknowledge the saved log messages.
This is done by navigating to the log file via the Open log entry and hitting Clear log.