{"record":{"id":"d817285efcffa93d","repo":"stamparm/maltrail","slug":"unable-to-write-event-log-e","errorCode":null,"errorMessage":"unable to write event log ({e})","messagePattern":"unable to write event log \\((.+?)\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sensor/src/output.rs","lineNumber":377,"sourceCode":"            // (An earlier comment here justified this with PIPE_BUF. That was wrong: PIPE_BUF\n            // bounds atomic writes to PIPES, not regular files. The property being relied on is\n            // O_APPEND's atomic offset-plus-write, which has no such size bound in practice but is\n            // also not unlimited — hence treating a short write as an error rather than looping.)\n            match file.write(line.as_bytes()) {\n                Ok(n) if n == line.len() => {}\n                Ok(n) => {\n                    self.log_write_errors += 1;\n                    log_error(\n                        &format!(\n                            \"short write to the event log ({n} of {} bytes); the record may be truncated\",\n                            line.len()\n                        ),\n                        true,\n                    )\n                }\n                Err(e) => {\n                    self.log_write_errors += 1;\n                    log_error(&format!(\"unable to write event log ({e})\"), true)\n                }\n            }\n        }\n    }\n\n    /// Matched against \"<info> <reference>\". Whether a verdict was corroborated lives in the\n    /// reference, and REMOTE_SEVERITY_REGEX has to see it to rank a heuristic guess below a feed\n    /// hit the way the dashboard does - `core/log.py:severity_of()` does the same.\n    fn severity_for(&self, info: &str, reference: &str) -> Severity {\n        let Some(re) = &self.cfg.severity_regex else {\n            return Severity::Medium;\n        };\n        match re.captures(&format!(\"{info} {reference}\")) {\n            Ok(Some(caps)) => {\n                for name in [\"low\", \"medium\", \"high\"] {\n                    if caps.name(name).is_some() {\n                        return match name {\n                            \"low\" => Severity::Low,","sourceCodeStart":359,"sourceCodeEnd":395,"githubUrl":"https://github.com/stamparm/maltrail/blob/77cfb06d7606506d101bbcec0786c77166c4255e/sensor/src/output.rs#L359-L395","documentation":"The event log write(2) call itself failed, so the event record was not written at all. The sensor counts the failure in log_write_errors and logs the wrapped OS error, but continues running rather than crashing.","triggerScenarios":"file.write(line.as_bytes()) returns Err(e) during write_event_log — e.g. ENOSPC, EBADF after the handle was closed/rotated underneath the sensor, or EIO on the underlying device.","commonSituations":"Log rotation tooling moved/deleted the file while the sensor holds a stale handle; disk full; I/O errors on failing storage hardware; filesystem remounted read-only.","solutions":["Read the wrapped {e} to identify the OS-level cause (ENOSPC → free space, EIO → check dmesg/storage health).","If a log rotator is in use, configure it to signal/rename safely or use a rotation mechanism compatible with the sensor's open handle.","Restart the sensor to re-open the event log if the handle has become stale (e.g. after rotation or unmount).","Monitor log_write_errors in metrics to gauge how many events were lost during the outage."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// the sensor increments log_write_errors and keeps running;\n// on the operator side, detect a stale handle and restart\nif log_write_errors_rate > threshold {\n    restart_sensor(); // reopens the event log after rotation/unmount\n}","preventionTips":["Use rotation tooling compatible with open handles (rename-then-recreate, not truncate-in-place under a stale fd)","Monitor log_write_errors and disk health (smartctl, dmesg)","Alert on ENOSPC before it occurs via disk usage alerts","Avoid remounting or unmounting the log filesystem while the sensor runs"],"tags":["file-io","logging","write-error"],"backgroundTag":"file-write-failed","analyzedSha":"77cfb06d7606506d101bbcec0786c77166c4255e","analyzedAt":"2026-09-13T03:50:16.010Z","contentChangedAt":"2026-09-13T03:50:16.010Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}