Load logpath only after findtime is configured #2173
When new log paths are configured, their start offset is immediately determined
So, findTime must be configured before logpath or else the default findtime
This fixes new reads on startup for actual log files. The systemd filter
It took me probably 10 hours to track down this problem. Spent a long time thinking regexes were just broken for half my jails because lookback-on-load worked reliably on some jails, but not others. Turns out the reliable jails were all systemd and loading from files was kinda broken. Then took a while to figure out how configs actually get loaded.
Additional Fixes Maybe
The newer config options
and, one minor change that may have helped cut hours off these debuggles: surfacing the initial lookback results in INFO mode instead of deep debug mode (here and here) would be nice for users to always know (since it's the start point for actually searching for bad actions on startup).
@@ Coverage Diff @@ ## 0.10 #2173 +/- ## ======================================= Coverage 95.57% 95.57% ======================================= Files 76 76 Lines 13190 13190 Branches 2081 2082 +1 ======================================= Hits 12607 12607 Misses 315 315 Partials 268 268
When new log paths are configured, their start offset is immediately determined by a filter searching for (now - findTime). But, since findTime is configured *after* the log is loaded and searched, logs are only searched back by the default 10 minute findTime, regardless of user configuration of jail settings. So, findTime must be configured before logpath or else the default findtime is used, which ignores any findtime time defined by the user. This fixes new reads on startup for actual log files. The systemd filter always performed as expected due to being setup after the jail's findtime config submission.
…position of `findtime` option in config); jailreader.py: additionally relocate the option `logpath` after all log-related data (backend, date-pattern, etc) that may be needed by the first usage (gh-2173). Thanks to Matt Stancliff (mattsta)