diff --git a/pkg/acquisition/modules/file/file.go b/pkg/acquisition/modules/file/file.go index 0c92de7f5..b11687d8f 100644 --- a/pkg/acquisition/modules/file/file.go +++ b/pkg/acquisition/modules/file/file.go @@ -20,7 +20,6 @@ import ( "github.com/pkg/errors" "github.com/prometheus/client_golang/prometheus" log "github.com/sirupsen/logrus" - "golang.org/x/sys/unix" "gopkg.in/tomb.v2" "gopkg.in/yaml.v2" ) @@ -230,11 +229,18 @@ func (f *FileSource) StreamingAcquisition(out chan types.Event, t *tomb.Tomb) er return f.monitorNewFiles(out, t) }) for _, file := range f.files { - err := unix.Access(file, unix.R_OK) + //cf. https://github.com/crowdsecurity/crowdsec/issues/1168 + //do not rely on stat, reclose file immediately as it's opened by Tail + fd, err := os.Open(file) if err != nil { f.logger.Errorf("unable to read %s : %s", file, err) continue } + if err := fd.Close(); err != nil { + f.logger.Errorf("unable to close %s : %s", file, err) + continue + } + fi, err := os.Stat(file) if err != nil { return fmt.Errorf("could not stat file %s : %w", file, err) @@ -300,9 +306,15 @@ func (f *FileSource) monitorNewFiles(out chan types.Event, t *tomb.Tomb) error { logger.Debugf("Already tailing file %s, not creating a new tail", event.Name) break } - err = unix.Access(event.Name, unix.R_OK) + //cf. https://github.com/crowdsecurity/crowdsec/issues/1168 + //do not rely on stat, reclose file immediately as it's opened by Tail + fd, err := os.Open(event.Name) if err != nil { - logger.Errorf("unable to read %s : %s", event.Name, err) + f.logger.Errorf("unable to read %s : %s", event.Name, err) + continue + } + if err := fd.Close(); err != nil { + f.logger.Errorf("unable to close %s : %s", event.Name, err) continue } //Slightly different parameters for Location, as we want to read the first lines of the newly created file diff --git a/pkg/acquisition/modules/file/file_test.go b/pkg/acquisition/modules/file/file_test.go index d176c154b..ddba16240 100644 --- a/pkg/acquisition/modules/file/file_test.go +++ b/pkg/acquisition/modules/file/file_test.go @@ -238,7 +238,7 @@ func TestLiveAcquisition(t *testing.T) { mode: tail filename: /etc/shadow`, expectedErr: "", - expectedOutput: "unable to read /etc/shadow : permission denied", + expectedOutput: "unable to read /etc/shadow : open /etc/shadow: permission denied", logLevel: log.InfoLevel, expectedLines: 0, },