Common error types in Simple Log Service data collection and their solutions - Simple Log Service

This topic describes common errors that can occur during data collection in Simple Log Service and provides their solutions.

Error type	Description	Solution
LOG_GROUP_WAIT_TOO_LONG_ALARM	A data packet waits too long to be sent after it is generated.	Check whether packets are being sent as expected. This error can be caused by a data volume that exceeds the default configuration, an insufficient quota, or network issues.
LOGFILE_PERMISSION_ALARM	Logtail does not have permission to read the specified file.	Check the Logtail startup account on the server. Resolve this by starting Logtail as the root user.
SPLIT_LOG_FAIL_ALARM	The regular expression for the start of a line does not match the log content, which prevents Logtail from splitting the log into separate lines.	Check whether the regular expression is correct. For single-line logs, set the regular expression to `.*`.
MULTI_CONFIG_MATCH_ALARM	By default, a log file can match only one Logtail configuration. If multiple Logtail configurations match the same file, only one takes effect. Note Multiple Logtail configurations can be used to collect the standard output from Docker.	Delete the redundant Logtail configurations. Modify the configurations to allow a file to match multiple Logtail configurations. For more information, see How do I collect multiple copies of logs from a file?.
REGEX_MATCH_ALARM	In full regular expression mode, the log content does not match the specified regular expression.	Copy the log sample from the error message to generate a new regular expression.
PARSE_LOG_FAIL_ALARM	In modes such as JSON and delimiter, parsing fails because the log format does not conform to the defined format.	Click the error message to view the detailed error report.
CATEGORY_CONFIG_ALARM	The Logtail collection configuration is invalid.	A common cause is that the regular expression failed to extract the file path to use as a topic.
LOGTAIL_CRASH_ALARM	Logtail crashed because it exceeded the server resource usage limit.	Increase the CPU and memory usage limits. For more information, see Set Logtail startup parameters.
REGISTER_INOTIFY_FAIL_ALARM	Logtail failed to register the log listener in Linux. This error may occur because Logtail does not have permission to access the folder, or the folder was deleted.	Check whether Logtail has permission to access the folder or whether the folder was deleted.
DISCARD_DATA_ALARM	The CPU resources configured for Logtail are insufficient, or throttling is triggered when data is sent over the network.	Increase the CPU usage limit or the network sending concurrency limit. For more information, see Set Logtail startup parameters.
SEND_DATA_FAIL_ALARM	An AccessKey pair has not been created for your Alibaba Cloud account. The server where the Logtail client is located cannot connect to Simple Log Service, or the network quality is poor. The write quota on the Simple Log Service server is insufficient.	Create an AccessKey pair for your Alibaba Cloud account. Check the local configuration file at /usr/local/ilogtail/ilogtail_config.json. Then, run the curl <Server address> command to check whether a response is returned. Increase the number of shards for the logstore to support a higher data write volume.
REGISTER_INOTIFY_FAIL_ALARM	Logtail failed to register the inotify watcher for the log directory.	Check whether the directory exists and verify its permission settings.
SEND_QUOTA_EXCEED_ALARM	The log write traffic exceeds the configured limit.	Increase the number of shards in the console. For more information, see Split a shard.
READ_LOG_DELAY_ALARM	Log collection is delayed and falling behind log generation. This error is usually caused by insufficient CPU resources for Logtail or by network sending throttling.	Increase the CPU usage limit or the network sending concurrency limit. For more information, see Set Logtail startup parameters. If you are importing historical data, a large amount of data is collected in a short period of time. You can ignore this error.
DROP_LOG_ALARM	Log collection is delayed, and the number of unprocessed rotated log files exceeds 20. This error is usually caused by insufficient CPU resources for Logtail or by network sending throttling.	Increase the CPU usage limit or the network sending concurrency limit. For more information, see Set Logtail startup parameters.
LOGDIR_PERMISSION_ALARM	Logtail does not have permission to read the log monitoring directory.	Check whether the log monitoring directory exists. If it does, verify its permission settings.
ENCODING_CONVERT_ALARM	Encoding conversion failed.	Check that the configured encoding format matches the actual encoding format of the log.
OUTDATED_LOG_ALARM	The logs are outdated because their timestamps are more than 12 hours older than the collection time. Possible causes include the following: Log parsing is delayed by more than 12 hours. The custom time field is incorrectly configured. The time output from the log recording program is abnormal.	Check whether a READ_LOG_DELAY_ALARM error is also reported. If it is, resolve that error first. If not, check the time field configuration. Check the time field configuration. If the configuration is correct, verify that the time output from the log recording program is normal.
STAT_LIMIT_ALARM	The number of files in the directory specified in the collection configuration exceeds the limit.	Check whether the target collection directory contains many files and subdirectories. Set an appropriate root directory for monitoring and specify a maximum monitoring depth for subdirectories. You can also modify the mem_usage_limit parameter. For more information, see Set Logtail startup parameters.
DROP_DATA_ALARM	Saving logs to the local disk timed out when the process exited. Any logs that were not saved are discarded.	This error usually occurs because the collection process is severely blocked. Increase the CPU usage limit or the network sending concurrency limit. For more information, see Set Logtail startup parameters.
INPUT_COLLECT_ALARM	An error occurred during collection from the input source.	Resolve the error based on the details in the error message.
HTTP_LOAD_ADDRESS_ALARM	The Addresses parameter specified in the HTTP data collection configuration is invalid.	Check whether the Addresses parameter is valid.
HTTP_COLLECT_ALARM	An error occurred during HTTP data collection.	Troubleshoot the issue based on the details in the error message. This error is usually caused by a timeout.
FILTER_INIT_ALARM	An error occurred during filter initialization.	This error is usually caused by an invalid regular expression in the filter. Correct the expression based on the details in the error message.
INPUT_CANAL_ALARM	A runtime error occurred in MySQL binary logging.	Troubleshoot the issue based on the details in the error message. The canal service may restart when the configuration is updated. Ignore errors that are caused by a service restart.
CANAL_INVALID_ALARM	The internal status of MySQL binary logging is abnormal.	This error usually occurs when a change to the table schema during runtime causes metadata inconsistency. Confirm whether the table schema was modified at the time the error was reported.
MYSQL_INIT_ALARM	An error occurred during MySQL initialization.	Resolve the error based on the details in the error message.
MYSQL_CHECKPOINT_ALARM	The MySQL checkpoint format is abnormal.	Confirm whether the checkpoint-related settings in this configuration have been modified.
MYSQL_TIMEOUT_ALARM	The MySQL query timed out.	Confirm that the MySQL server and network are functioning normally.
MYSQL_PARSE_ALARM	Failed to parse the MySQL query results.	Confirm that the checkpoint format in the MySQL configuration matches the format of the corresponding field.
AGGREGATOR_ADD_ALARM	Failed to add data to the queue.	This error indicates that data is being sent too quickly. Ignore this error if the actual data volume is large.
ANCHOR_FIND_ALARM	An error occurred in the processor_anchor plugin. This can be caused by an incorrect configuration or by logs that do not conform to the configuration.	Click the error link to view the detailed error message. The error has the following subtypes. Check your configuration based on the details of the specific subtype. `anchor cannot find key`: The SourceKey parameter is specified in the configuration, but the corresponding field is not found in the logs. `anchor no start`: A match for the Start parameter cannot be found in the value of the SourceKey field. `anchor no stop`: A match for the Stop parameter cannot be found in the value of the SourceKey field.
ANCHOR_JSON_ALARM	An error occurred in the processor_anchor plugin when expanding the JSON content defined by the Start and Stop parameters.	Click the error link to view the detailed error message. Check the content being processed and the related configurations to identify configuration errors or find invalid logs.
CANAL_RUNTIME_ALARM	A runtime error occurred in the binary logging plugin.	Click the error link to view the detailed error message and troubleshoot the issue. This error is usually related to the connected primary MySQL instance.
CHECKPOINT_INVALID_ALARM	Failed to parse the checkpoint.	Click the error link to view the detailed error message. Troubleshoot the issue based on the checkpoint key, checkpoint content (the first 1024 bytes), and the specific error message.
DIR_EXCEED_LIMIT_ALARM	The number of directories that Logtail is listening to simultaneously exceeds the limit.	Check whether the collection configuration for the current logstore and other configurations applied to Logtail involve many directories. Set an appropriate root directory for monitoring and specify a maximum monitoring depth for subdirectories.
DOCKER_FILE_MAPPING_ALARM	Logtail failed to add a Docker file mapping by running a command.	Click the error link to view the detailed error message. Troubleshoot the issue based on the command and the specific error message.
DOCKER_FILE_MATCH_ALARM	The specified file cannot be found in the Docker container.	Click the error link to view the detailed error message. Troubleshoot the issue based on the container information and the file path being searched.
DOCKER_REGEX_COMPILE_ALARM	An error occurred in the service_docker_stdout plugin. The plugin failed to compile the BeginLineRegex from the configuration.	Click the error link to view the detailed error message. Check whether the regular expression is correct.
DOCKER_STDOUT_INIT_ALARM	The service_docker_stdout plugin failed to initialize.	Click the error link to view the detailed error message. The error has the following subtypes. `host...version...error`: Check whether the Docker Engine specified in the configuration is accessible. `load checkpoint error`: The plugin failed to load the checkpoint file. You can ignore this error if it does not affect your business operations. `container...`: The `label` `value` for the specified `container` is invalid. Valid values are `stdout` and `stderr`. For more information, see the error message.
DOCKER_STDOUT_START_ALARM	The stdout size exceeds the limit during collection by the service_docker_stdout plugin.	This error usually occurs if stdout data already exists during the first collection. Ignore this error.
DOCKER_STDOUT_STAT_ALARM	The service_docker_stdout plugin cannot detect the stdout.	This error usually occurs because stdout is inaccessible when the container exits. Ignore this error.
FILE_READER_EXCEED_ALARM	The number of file objects that Logtail has open simultaneously exceeds the limit.	This error usually occurs because too many files are being collected at the same time. Check whether the collection configuration is reasonable.
GEOIP_ALARM	An error occurred in the processor_geoip plugin.	Click the error link to view the detailed error message. The error has the following subtypes. `invalid ip...`: The plugin failed to obtain an IP address. Check whether the SourceKey in the configuration is correct or if invalid logs exist. `parse ip...`: The plugin failed to resolve the city from the IP address. Check the detailed error message to troubleshoot the issue. `cannot find key...`: The specified SourceKey cannot be found in the logs. Check whether the configuration is correct or if invalid logs exist.
HTTP_INIT_ALARM	An error occurred in the metric_http plugin. The ResponseStringMatch regular expression specified in the configuration failed to compile.	Click the error link to view the detailed error message. Check whether the regular expression is correct.
HTTP_PARSE_ALARM	An error occurred in the metric_http plugin. The plugin failed to retrieve the HTTP response.	Click the error link to view the detailed error message. Check the configuration content or the requested HTTP server based on the specific error message.
INIT_CHECKPOINT_ALARM	An error occurred in the binary logging plugin. The plugin failed to load the checkpoint file. The plugin ignores the checkpoint and starts processing from the beginning.	Click the error link to view the detailed error message. Determine whether to ignore this error based on the specific error information.
LOAD_LOCAL_EVENT_ALARM	Logtail is handling a local event.	This warning is uncommon. If it is not caused by a manual operation, you must troubleshoot the issue. Click the error link to view the detailed error message. Troubleshoot the issue based on the file name, configuration name, project, and logstore.
LOG_REGEX_FIND_ALARM	An error occurred in the processor_split_log_regex and processor_split_log_string plugins. The SplitKey specified in the configuration cannot be found in the logs.	Click the error link to view the detailed error message and check for configuration errors.
LUMBER_CONNECTION_ALARM	An error occurred in the service_lumberjack plugin. The server was shut down while the plugin was stopping.	Click the error link to view the detailed error message. Troubleshoot the issue based on the specific error information. You can usually ignore this error.
LUMBER_LISTEN_ALARM	An error occurred in the service_lumberjack plugin during listener initialization.	Click the error link to view the detailed error message. The error has the following subtypes. `init tls error...`: Check whether the TLS-related configurations are correct based on the specific error message. `listen init error...`: Check whether the address-related configurations are correct based on the specific error message.
LZ4_COMPRESS_FAIL_ALARM	An error occurred when Logtail performed LZ4 compression.	Click the error link to view the detailed error message. Troubleshoot the issue based on the values of the log lines, project, category, and region.
MYSQL_CHECKPOINT_ALARM	An error occurred in the MySQL plugin related to checkpoints.	Click the error link to view the detailed error message. The error has the following subtypes. `init checkpoint error...`: The plugin failed to initialize the checkpoint. Check the checkpoint column specified in the configuration and the retrieved values based on the error message. `not matched checkpoint...`: The checkpoint information does not match. Check whether the error was caused by a manual operation, such as a configuration update. If so, ignore the error.
NGINX_STATUS_COLLECT_ALARM	An error occurred in the nginx_status plugin while retrieving the status.	Click the error link to view the detailed error message. Troubleshoot the issue based on the URL and the specific error information.
NGINX_STATUS_INIT_ALARM	An error occurred in the nginx_status plugin. The plugin failed to initialize and parse the URL specified in the configuration.	Click the error link to view the detailed error message. Check whether the URL is configured correctly.
OPEN_FILE_LIMIT_ALARM	The number of files opened by Logtail exceeds the limit, and no new files can be opened.	Click the error link to view the detailed error message. Troubleshoot the issue based on the log file path, project, and logstore.
OPEN_LOGFILE_FAIL_ALARM	An error occurred when Logtail tried to open a file.	Click the error link to view the detailed error message. Troubleshoot the issue based on the log file path, project, and logstore.
PARSE_DOCKER_LINE_ALARM	An error occurred in the service_docker_stdout plugin. The plugin failed to parse the log.	Click the error link to view the detailed error message. The error has the following subtypes. `parse docker line error: empty line`: The log line is empty. `parse json docker line error...`: The plugin failed to parse the log in JSON format. Troubleshoot the issue based on the error message and the first 512 bytes of the log. `parse cri docker line error...`: The plugin failed to parse the log in CRI format. Troubleshoot the issue based on the error message and the first 512 bytes of the log.
PLUGIN_ALARM	An error occurred during plugin initialization and related calls.	Click the error link to view the detailed error message. The error has the following subtypes. Troubleshoot the issue based on the specific error details. `init plugin error...`: Failed to initialize the plugin. `hold on error...`: Failed to pause the plugin. `resume error...`: Failed to resume the plugin. `start service error...`: Failed to start a service input type plugin. `stop service error...`: Failed to stop a service input type plugin.
PROCESSOR_INIT_ALARM	An error occurred in the processor_regex plugin. The plugin failed to compile the Regex regular expression specified in the configuration.	Click the error link to view the detailed error message. Check whether the regular expression is correct.
PROCESS_TOO_SLOW_ALARM	Logtail is parsing logs too slowly.	Click the error link to view the detailed error message. Check the log quantity, buffer size, and parsing time to determine whether the speed is normal. If the speed is too slow, check whether other processes on the Logtail node are consuming excessive CPU resources or if there are inefficient parsing configurations, such as an inefficient regular expression.
REDIS_PARSE_ADDRESS_ALARM	An error occurred in the Redis plugin. The plugin failed to parse the ServerUrls provided in the configuration.	Click the error link to view the detailed error message. Check the URL for which the error was reported.
REGEX_FIND_ALARM	An error occurred in the processor_regex plugin. The plugin cannot find the field specified by SourceKey in the configuration.	Click the error link to view the detailed error message. Check for an incorrect SourceKey configuration or invalid logs.
REGEX_UNMATCHED_ALARM	An error occurred in the processor_regex plugin. A match failed.	Click the error link to view the detailed error message. The error has the following subtypes. Troubleshoot the issue based on the specific error information. `unmatch this log content...`: The log content does not match the regular expression in the configuration. `match result count less...`: The number of matched results is less than the configured number of Keys.
SAME_CONFIG_ALARM	A configuration with the same name already exists for the logstore. The configuration that is discovered later is discarded.	Click the error link to view the detailed error message. Check for configuration errors based on the configuration path and other information.
SPLIT_FIND_ALARM	An error occurred in the split_char and split_string plugins. The plugins cannot find the field specified by SourceKey in the configuration.	Click the error link to view the detailed error message. Check for an incorrect SourceKey configuration or invalid logs.
SPLIT_LOG_ALARM	An error occurred in the processor_split_char and processor_split_string plugins. The number of parsed fields is different from the number specified in SplitKeys.	Click the error link to view the detailed error message. Check for an incorrect SourceKey configuration or invalid logs.
STAT_FILE_ALARM	An error occurred when collecting data from a file using the LogFileReader object.	Click the error link to view the detailed error message. Troubleshoot the issue based on the file path and error information.
SERVICE_SYSLOG_INIT_ALARM	An error occurred in the service_syslog plugin. The plugin failed to initialize.	Click the error link to view the detailed error message. Check whether the Address parameter in the configuration is correct.
SERVICE_SYSLOG_STREAM_ALARM	An error occurred in the service_syslog plugin during data collection over TCP.	Click the error link to view the detailed error message. The error has the following subtypes. Troubleshoot the issue based on the specific error details. `accept error...`: An error occurred when running the Accept command. The plugin waits for a period of time and then retries the operation. `setKeepAlive error...`: The plugin failed to set Keep-Alive. The plugin skips this error and continues. `connection i/o timeout...`: A TCP read operation timed out. The plugin resets the timeout period and continues to read data. `scan error...`: A TCP read error occurred. The plugin waits for a period of time and then retries the operation.
SERVICE_SYSLOG_PACKET_ALARM	An error occurred in the service_syslog plugin during data collection over UDP.	Click the error link to view the detailed error message. The error has the following subtypes. Troubleshoot the issue based on the specific error details. `connection i/o timeout...`: A UDP read operation timed out. The plugin resets the timeout period and continues to read data. `read from error...`: A UDP read error occurred. The plugin waits for a period of time and then retries the operation.
PARSE_TIME_FAIL_ALARM	The plugin failed to parse the log time.	Identify and resolve the issue in one of the following ways: Check whether the time field extracted by the regular expression is correct. Check whether the content of the specified time field matches the time expression in the configuration.