Prefixes that cannot be used when specifying paths to files:
- /*
- /bin
- /boot
- /dev
- /etc
- /home
- /lib
- /lib64
- /proc
- /root
- /run
- /sys
- /tmp
- /usr/*
- /usr/bin/
- /usr/local/*
- /usr/local/sbin/
- /usr/local/bin/
- /usr/sbin/
- /usr/lib/
- /usr/lib64/
- /var/*
- /var/lib/
- /var/run/
- /opt/kaspersky/kuma/
Files are available at the following paths:
- /opt/kaspersky/kuma/clickhouse/logs/
- /opt/kaspersky/kuma/mongodb/log/
- /opt/kaspersky/kuma/victoria-metrics/log/
The number of files simultaneously watched by mask can be limited by the max_user_watches setting of the Core. To view the value of a setting, run the following command:
cat /proc/sys/fs/inotify/max_user_watches
If the number of files for watching exceeds the value of the max_user_watches setting, the collector cannot read any more events from the files and the following error is written to the collector log:
Failed to add files for watching {"error": "no space left on device"}
To make sure that the collector continues to work correctly, you can configure the appropriate rotation of files so that the number of files does not exceed the value of the max_user_watches setting, or increase the max_user_watches value.
To increase the value of the setting:
sysctl fs.inotify.max_user_watches=<number of files>
sysctl -p
You can also add the value of the max_user_watches setting to sysctl.conf so make sure it is kept indefinitely.
After you increase the value of the max_user_watches setting, the collector resumes correct operation.