microsoft / microsoft/windows-container-tools

[BUG] LogMonitor keeps executing CreateFile Operations for deleted files, skyrocketing the cost of running this in AKS + Azure File Shares

Open
#219 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
277
Forks
77
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
After a file is deleted on a folder monitored by LogMonitor.exe, it keeps on getting attempted to be used by it unless the LogMonitor.exe process is stopped.
This causes a lot of reads if you delete files that you no longer need, like for example you're looking to only keep log files older than a month in storage.

To Reproduce

  1. Create a container that has the following LogMonitor.exe configuration:
{
    "LogConfig": {
        "sources": [
            {
                "directory": "C:\\my\\folder\\appserverlogs",
                "filter": "*.txt",
                "includeFileNames": true,
                "includeSubdirectories": true,
                "type": "File"
            }
        ]
    }
}
  1. Add multiple files into that folder
  2. Delete some of the files in that folder
  3. Open procmon.exe and monitor for the deleted files, you'll get the following entries, which would result in Cloud providers, like for example Azure, charge the customer with additional writes for every attempt of the deleted files to be read via a CreateFile Operation
  4. Image

Expected behavior
Deleted files from the monitored locations should stop being monitored if they no longer exist.

Screenshots
Screenshot provided of procmon.exe, a memory dump and a procmon.exe PML file are available to be sent to your team for analysis

Configuration
-Tool: Log Monitor
-Version: 2.0.0.0 or 2.0.0._LM_BUILDMIINNOVERSION

Additional context
NA

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Begin with the LogMonitor.exe file-monitoring path and reproduce the issue using the supplied JSON configuration while observing deleted-file activity in procmon.exe. Done means deleted files no longer trigger CreateFile attempts after deletion; no source file or test is identified in the issue, so locating coverage is part of the work.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, cpp
Domain
cloud, devtools, observability
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.