This topic describes the common errors that occur when Log Service collects data and the solutions to the errors.

If you encounter the errors that are not described in this topic, submit a ticket.
Error Description Solution
LOG_GROUP_WAIT_TOO_LONG_ALARM After a data packet is generated, the system waits a long time to send the packet. Check whether the system sends packets as expected, the data volume exceeds the default limit, the quota is insufficient, or network errors occur.
LOGFILE_PERMINSSION_ALARM Logtail has no permissions to read the specified file. Check whether the startup account of Logtail on the server is root. The root account is recommended.
SPLIT_LOG_FAIL_ALARM Logtail fails to split logs into lines because the regular expression that is specified to match the beginning of the first line of a log does not match the content in the logs. Check whether the regular expression is correct.

If you want to collect single-line logs, you can specify .* as the regular expression.

MULTI_CONFIG_MATCH_ALARM By default, you can use only one Logtail configuration to collect logs from a log file. If you use multiple Logtail configurations to collect logs from a log file, only one Logtail configuration takes effect.
Note You can use multiple Logtail configurations to collect the stdout and stderr of Docker containers.
REGEX_MATCH_ALARM In full regex mode, log content does not match the regular expression that is specified. Copy the sample log in the error details to generate a new regular expression.
PARSE_LOG_FAIL_ALARM In modes such as JSON and delimiter, Logtail fails to parse logs because the log format does not conform to the defined format. Click the error link to view details.
CATEGORY_CONFIG_ALARM The Logtail configuration is invalid. A common reason is that the specified regular expression fails to extract a part of the file path as a topic. If this error is caused by a different reason, submit a ticket.
LOGTAIL_CRASH_ALARM Logtail stops responding because its server resource usage exceeds the upper limit. Change the upper limits of CPU utilization and memory usage to larger values. For more information, see Configure the startup parameters of Logtail.
REGISTER_INOTIFY_FAIL_ALARM Logtail fails to register the log listener in Linux. This error may occur because Logtail has no permissions to access the folder that Logtail listens on or the folder has been deleted. Check whether Logtail has the permissions to access the folder or the folder is deleted.
DISCARD_DATA_ALARM The CPU resources configured for Logtail are insufficient, or throttling is triggered on sending network data. Change the upper limit of CPU utilization or the limit of concurrent operations to send network data to a larger value. For more information, see Configure the startup parameters of Logtail.
SEND_DATA_FAIL_ALARM
  • No AccessKey pair is created for your Alibaba Cloud account.
  • The server on which Logtail runs cannot connect to Log Service, or network quality is poor.
  • The write quota is insufficient on Log Service.
  • Create an AccessKey pair for your Alibaba Cloud account.
  • Check the local configuration file /usr/local/ilogtail/ilogtail_config.json and run the curl <Server address> command to check whether any content is returned.
  • Increase the number of shards for the Logstore so that more data can be written to the Logstore.
REGISTER_INOTIFY_FAIL_ALARM Logtail fails to register the inotify watcher for the log directory. Check whether the log directory exists and check the permission settings of the directory.
SEND_QUOTA_EXCEED_ALARM The log write traffic exceeds the limit. Increase the number of shards in the Log Service console. For more information, see Split a shard.
READ_LOG_DELAY_ALARM Log collection lags behind log generation. In most cases, this error occurs because the CPU resources configured for Logtail are insufficient or throttling is triggered on sending network data. Change the upper limit of CPU utilization or the limit of concurrent operations to send network data to a larger value. For more information, see Configure the startup parameters of Logtail.
DROP_LOG_ALARM Log collection lags behind log generation, and the number of log files that are generated during rotation and are not parsed exceeds 20. In most cases, this error occurs because the CPU resources configured for Logtail are insufficient or throttling is triggered on sending network data. Change the upper limit of CPU utilization or the limit of concurrent operations to send network data to a larger value. For more information, see Configure the startup parameters of Logtail.
LOGDIR_PERMINSSION_ALARM Logtail has no permissions to read the log directory. Check whether the log directory exists. If the directory exists, check the permission settings of the directory.
ENCODING_CONVERT_ALARM Encoding fails. Check whether the configuration for log encoding is consistent with the actual implementation of log encoding.
OUTDATED_LOG_ALARM The logs are expired. The log time lags behind the collection time for more than 12 hours. Possible causes:
  • The log parsing progress lags behind the expected time for more than 12 hours.
  • The custom time field is incorrectly configured.
  • The time output of the log recording program is invalid.
  • Check whether the READ_LOG_DELAY_ALARM error is reported.

    If the error is reported, fix the error. If the error is not reported, check the configuration of the time field.

  • Check the configuration of the time field. If the time field is correctly configured, check whether the time output of the log recording program is valid.
STAT_LIMIT_ALARM The number of files in the log directory that is specified in the Logtail configuration exceeds the limit. Check whether the log directory contains a large number of files and subdirectories. Reconfigure the log directory for monitoring and the maximum number of levels of subdirectories that you want to monitor.

You can also modify the mem_usage_limit parameter. For more information, see Configure the startup parameters of Logtail.

DROP_DATA_ALARM When the Logtail process exits, logs are dumped to the local disk. However, the dump operation times out. As a result, the logs that are not dumped to the local disk are discarded. In most cases, this error occurs because collection is severely blocked. You can change the upper limit of CPU utilization or the limit of concurrent operations to send network data to a larger value. For more information, see Configure the startup parameters of Logtail.
INPUT_COLLECT_ALARM An error occurs when data is collected from the input data source. Fix the error based on the error details.
HTTP_LOAD_ADDRESS_ALARM The value of Addresses specified in the Logtail configuration that is used to collect HTTP data is invalid. Specify a valid value for Addresses.
HTTP_COLLECT_ALARM An error occurs in collecting HTTP data. Fix the error based on the error details. In most cases, this error is caused by timeout.
FILTER_INIT_ALARM An error occurs in initializing the filter. In most cases, this error is caused by the invalid regular expressions of the filter. Fix the error based on the error details.
INPUT_CANAL_ALARM An error occurs in the plug-in that is used to collect MySQL binary logs. Fix the error based on the error details.

When a Logtail configuration is updated, the canal service may restart. If the error is caused by the service restart, you can ignore the error.

CANAL_INVALID_ALARM The plug-in that is used to collect MySQL binary logs is abnormal. In most cases, this error is caused by inconsistent metadata. Metadata inconsistency may occur due to table scheme changes during running. Check whether changes are made to table schemas in the period during which the error is repeatedly reported. If the error is caused by a different reason, submit a ticket.
MYSQL_INIT_ALARM An error occurs during MySQL initialization. Fix the error based on the error details.
MYSQL_CHECKPOING_ALARM The format of the checkpoints that are used for MySQL data collection is invalid. Check whether to modify the checkpoint-related settings in the Logtail configuration. If the error is caused by a different reason, submit a ticket.
MYSQL_TIMEOUT_ALARM The MySQL query times out. Check whether the MySQL server is properly connected to the network.
MYSQL_PARSE_ALARM The MySQL query results fail to be parsed. Check whether the format of the checkpoints that are used for MySQL data collection matches the format of the required fields.
AGGREGATOR_ADD_ALARM The system fails to add data to the queue. Data is sent too fast. If large amounts of data need to be sent, you can ignore this error.
ANCHOR_FIND_ALARM An error occurs in the processor_anchor plug-in, an error occurs in the Logtail configuration, or logs that do not match the Logtail configuration exist. Click the error link to view the sub-type of the error. The following sub-types are available. You can check settings based on the error details of each sub-type.
  • anchor cannot find key: SourceKey is configured in the Logtail configuration, but the specified fields are not found in logs.
  • anchor no start: The system cannot find a match for Start in the value of SourceKey.
  • anchor no stop: The system cannot find a match for Stop in the value of SourceKey.
ANCHOR_JSON_ALARM An error occurs in the processor_anchor plug-in. The plug-in fails to expand the JSON data that is extracted based on the configured Start and Stop. Click the error link to view details. Examine collected logs and related configurations to check whether configuration errors or invalid logs exist.
CANAL_RUNTIME_ALARM An error occurs in the plug-in that is used to collect MySQL binary logs. Click the error link to view details and perform troubleshooting based on the details. In most cases, this error is related to the primary ApsaraDB RDS for MySQL instance that is connected.
CHECKPOINT_INVALID_ALARM The system fails to parse checkpoints. Click the error link to view details and perform troubleshooting based on the details and the key-value pairs of the checkpoints in the details. The values of the checkpoints are indicated by the first 1,024 bytes in the checkpoint file.
DIR_EXCEED_LIMIT_ALARM The number of directories that Logtail listens on at the same time exceeds the limit. Check whether the Logtail configurations whose data is stored to the current Logstore and other Logtail configurations on the server on which Logtail is installed involve a large number of subdirectories. Reconfigure the log directory for monitoring and the maximum number of levels of subdirectories that you want to monitor for each Logtail configuration.
DOCKER_FILE_MAPPING_ALARM The system fails to add a Docker file mapping by running a Logtail command. Click the error link to view details and perform troubleshooting based on the details and the command in the details.
DOCKER_FILE_MATCH_ALARM The specified file cannot be found in the Docker container. Click the error link to view details and perform troubleshooting based on the container information and the file path that is used for the search.
DOCKER_REGEX_COMPILE_ALARM An error occurs in the service_docker_stdout plug-in. Compiling based on BeginLineRegex fails. Click the error link to view details and check whether the regular expression in the details is correct.
DOCKER_STDOUT_INIT_ALARM The service_docker_stdout plug-in fails to be initialized. Click the error link to view the sub-type of the error. The following sub-types are available:
  • host...version...error: You can check whether the Docker engine specified in the Logtail configuration is accessible.
  • load checkpoint error: The system fails to load the checkpoint file. If this error does not affect your business, you can ignore this error.
  • container...: The specified container has invalid label values. Only stdout and stderr are supported. Perform troubleshooting based on the error details.
DOCKER_STDOUT_START_ALARM The stdout size exceeds the limit when the service_docker_stdout plug-in is used to collect data. In most cases, this error occurs because the stdout already exists when you use the plug-in for the first time. You can ignore this error.
DOCKER_STDOUT_STAT_ALARM The service_docker_stdout plug-in cannot find the stdout. In most cases, this error occurs because no stdout is available when a container terminates. You can ignore this error.
FILE_READER_EXCEED_ALARM The number of files that Logtail opens at the same time exceeds the limit. In most cases, this error occurs because Logtail is collecting logs from a large number of files. Check whether the settings of the Logtail configuration are proper.
GEOIP_ALARM An error occurs in the processor_geoip plug-in. Click the error link to view the sub-type of the error. The following sub-types are available:
  • invalid ip...: The system fails to obtain an IP address. Check whether SourceKey in the Logtail configuration is correctly configured or whether invalid logs exist.
  • parse ip...: The system fails to parse an IP address into a city. Perform troubleshooting based on the error details.
  • cannot find key...: The system cannot find a match for SourceKey in logs. Check whether the Logtail configuration is correct or whether invalid logs exist.
HTTP_INIT_ALARM An error occurs in the metric_http plug-in. The plug-in fails to compile the regular expression specified by the ResponseStringMatch parameter in the Logtail configuration. Click the error link to view details and check whether the regular expression in the details is correct.
HTTP_PARSE_ALARM An error occurs in the metric_http plug-in. The plug-in fails to obtain HTTP responses. Click the error link to view details and check the Logtail configuration or the requested HTTP server based on the details.
INIT_CHECKPOINT_ALARM An error occurs in the plug-in that is used to collect binary logs. The plug-in fails to load the checkpoint file and starts data processing from the beginning without a checkpoint. Click the error link to view details and determine whether to ignore the error based on the details.
LOAD_LOCAL_EVENT_ALARM Logtail performs local event handling. This error does not usually occur. If this error is caused by a non-human operation, you must perform troubleshooting. You can click the error link to view details and perform troubleshooting based on the file name, Logtail configuration name, project, and Logstore in the details.
LOG_REGEX_FIND_ALARM Errors occur in the processor_split_log_regex and processor_split_log_string plug-ins. The plug-ins cannot find a match for SplitKey in logs. Click the error link to view details and check whether configuration errors exist.
LUMBER_CONNECTION_ALARM An error occurs in the service_lumberjack plug-in. The server is shut down while the plug-in is stopped. Click the error link to view details and perform troubleshooting based on the details. In most cases, you can ignore this error.
LUMBER_LISTEN_ALARM An error occurs in the service_lumberjack plug-in. The plug-in fails to perform listening during initialization. Click the error link to view the sub-type of the error. The following sub-types are available:
  • init tls error...: Check whether TLS-related configurations are correct based on the error details.
  • listen init error...: Check whether address-related configurations are correct based on the error details.
LZ4_COMPRESS_FAIL_ALARM An error occurs when Logtail performs LZ4 compression. Click the error link to view details and perform troubleshooting based on the values of log lines, project, category, and region in the details.
MYSQL_CHECKPOINT_ALARM An error occurs in the plug-in that is used for MySQL data collection. The error is related to checkpoints. Click the error link to view the sub-type of the error. The following sub-types are available:
  • init checkpoint error...: Checkpoint initialization fails. Check the checkpoint column specified by the Logtail configuration based on the error details and check whether the obtained values are correct.
  • not matched checkpoint...: Logs do not match the checkpoint information. Check whether the mismatch is caused by user operations such as configuration update based on the error details. If the mismatch is caused by user operations, you can ignore the error.
NGINX_STATUS_COLLECT_ALARM An error occurs in the nginx_status plug-in. The plug-in fails to obtain status information. Click the error link to view details and perform troubleshooting based on the details and the URLs in the details.
NGINX_STATUS_INIT_ALARM An error occurs in the nginx_status plug-in. The plug-in fails to initialize the URLs specified in parsing configurations. Click the error link to view details and check whether the URLs in the details are correct.
OPEN_FILE_LIMIT_ALARM Logtail fails to open the file because the number of opened files exceeds the limit. Click the error link to view details and perform troubleshooting based on the file path, project, and Logstore in the details.
OPEN_LOGFILE_FAIL_ALARM An error occurs when Logtail opens the file. Click the error link to view details and perform troubleshooting based on the file path, project, and Logstore in the details.
PARSE_DOCKER_LINE_ALARM An error occurs in the service_docker_stdout plug-in. The plug-in fails to parse the log. Click the error link to view the sub-type of the error. The following sub-types are available:
  • parse docker line error: empty line: The log is empty.
  • parse json docker line error...: The system fails to parse the log into the JSON format. Perform troubleshooting based on the error details and the first 512 bytes of the log.
  • parse cri docker line error...: The system fails to parse the log into the CRI format. Perform troubleshooting based on the error details and the first 512 bytes of the log.
PLUGIN_ALARM An error occurs in initializing and calling plug-ins. Click the error link to view the sub-type of the error. The following sub-types are available. You can perform troubleshooting based on the error details.
  • init plugin error...: The system fails to initialize a plug-in.
  • hold on error...: The system fails to suspend a plug-in.
  • resume error...: The system fails to resume a plug-in.
  • start service error...: The system fails to start a plug-in of the service input type.
  • stop service error...: The system fails to stop a plug-in of the service input type.
PROCESSOR_INIT_ALARM An error occurs in the processor_regex plug-in. The plug-in fails to compile the regular expression specified in the Logtail configuration. Click the error link to view details and check whether the regular expression in the details is correct.
PROCESS_TOO_SLOW_ALARM Logtail parses logs too slowly.
  1. Click the error link to view details and check whether the parsing speed is acceptable based on the log quantity, buffer size, and parsing time in the details.
  2. If the speed is too slow, check whether other processes on the server on which Logtail is installed occupy excessive CPU resources or whether inappropriate parsing configurations exist, such as inefficient regular expressions.
REDIS_PARSE_ADDRESS_ALARM An error occurs in the redis plug-in. The plug-in fails to parse the value of ServerUrls provided in the Logtail configuration. Click the error link to view details. Check the URLs for which the error is reported.
REGEX_FIND_ALARM An error occurs in the processor_regex plug-in. The plug-in fails to find the fields specified by SourceKey in logs. Click the error link to view details. Check whether SourceKey is correctly configured or whether the logs are valid.
REGEX_UNMATCHED_ALARM An error occurs in the processor_regex plug-in. The match operation of the plug-in fails. Click the error link to view the sub-type of the error. The following sub-types are available. You can perform troubleshooting based on the error details.
  • unmatch this log content...: The system fails to match logs against the regular expression specified in the Logtail configuration.
  • match result count less...: The number of matched fields is less than the number of fields specified by Keys in the Logtail configuration.
SAME_CONFIG_ALARM Duplicate Logtail configurations are found for a Logstore. The Logtail configuration that is most recently found is discarded. Click the error link to view details. Check whether configuration errors exist based on the details and the Logtail configuration path in the details.
SPLIT_FIND_ALARM Errors occur in the split_char and split_string plug-ins. The plug-ins fail to find the fields specified by SourceKey in logs. Click the error link to view details. Check whether SourceKey is correctly configured or whether the logs are valid.
SPLIT_LOG_ALARM Errors occur in the processor_split_char and processor_split_string plug-ins. The number of parsed fields is different from the number of fields specified by SplitKeys. Click the error link to view details. Check whether SourceKey is correctly configured or whether the logs are valid.
STAT_FILE_ALARM An error occurs when the LogFileReader object is used to collect data from a file. Click the error link to view details and perform troubleshooting based on the details and the file path in the details.
SERVICE_SYSLOG_INIT_ALARM An error occurs in the service_syslog plug-in. The plug-in fails to be initialized. Click the error link to view details. Check whether Address in the Logtail configuration is correctly configured.
SERVICE_SYSLOG_STREAM_ALARM An error occurs in the service_syslog plug-in. The plug-in fails to collect data over TCP. Click the error link to view the sub-type of the error. The following sub-types are available. You can perform troubleshooting based on the error details.
  • accept error...: An error occurs when the Accept command is run. The plug-in waits for a while and try again.
  • setKeepAlive error...: The system fails to configure Keep Alive. The plug-in skips this error and continues.
  • connection i/o timeout...: A TCP read times out. The plug-in modifies the timeout period and continues to read data.
  • scan error...: A TCP read error occurs. The plug-in waits for a while and try again.
SERVICE_SYSLOG_PACKET_ALARM An error occurs in the service_syslog plug-in. The plug-in fails to collect data over UDP. Click the error link to view the sub-type of the error. The following sub-types are available. You can perform troubleshooting based on the error details.
  • connection i/o timeout...: A UDP read times out. The plug-in modifies the timeout period and continues to read data.
  • read from error...: A UDP read error occurs. The plug-in waits for a while and try again.
PARSE_TIME_FAIL_ALARM The system fails to parse the log time. You can use one of the following methods to identify the cause of the error and fix the error:
  • Check whether the time field extracted by using a regular expression is correct.
  • Check whether the value of the specified time field matches the time expression specified in the Logtail configuration.