bugfix: imfile potentially duplicates lines

This can happen when 0 bytes are read from the input file, and some
writer appends data to the file BEFORE we check if a rollover happens.
The check for rollover uses the inode and size as a criterion. So far,
we checked for equality of sizes, which is not given in this scenario,
but that does not indicate a rollover. From the source code comments:
   Note that when we check the size, we MUST NOT check for equality.
   The reason is that the file may have been written right after we
   did try to read (so the file size has increased). That is NOT in
   indicator of a rollover (this is an actual bug scenario we
   experienced). So we need to check if the new size is smaller than
   what we already have seen!

2 files changed, 17 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 3c7d3c4c..951a0703 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,17 @@
 ---------------------------------------------------------------------------
 Version 4.6.6  [v4-stable] (rgerhards), 2010-11-??
+- bugfix: imfile potentially duplicates lines
+  This can happen when 0 bytes are read from the input file, and some
+  writer appends data to the file BEFORE we check if a rollover happens.
+  The check for rollover uses the inode and size as a criterion. So far,
+  we checked for equality of sizes, which is not given in this scenario,
+  but that does not indicate a rollover. From the source code comments:
+     Note that when we check the size, we MUST NOT check for equality.
+     The reason is that the file may have been written right after we
+     did try to read (so the file size has increased). That is NOT in
+     indicator of a rollover (this is an actual bug scenario we 
+     experienced). So we need to check if the new size is smaller than
+     what we already have seen!
 - bugfix: a couple of problems that imfile had on some platforms, namely
   Ubuntu (not their fault, but occured there)
 - bugfix: imfile utilizes 32 bit to track offset. Most importantly,
diff --git a/runtime/stream.c b/runtime/stream.c
index 869324ec..baf69881 100644
--- a/runtime/stream.c
+++ b/runtime/stream.c
@@ -422,10 +422,15 @@ strmHandleEOFMonitor(strm_t *pThis)
 		ABORT_FINALIZE(RS_RET_IO_ERROR);
 	if(stat((char*) pThis->pszCurrFName, &statName) == -1)
 		ABORT_FINALIZE(RS_RET_IO_ERROR);
+	DBGPRINTF("stream checking for file change on '%s', inode %u/%u, size %lld/%lld\n",
+	  pThis->pszCurrFName, (unsigned) statOpen.st_ino,
+	  (unsigned) statName.st_ino,
+	  pThis->iCurrOffs, (long long) statName.st_size);
 	if(statOpen.st_ino == statName.st_ino && pThis->iCurrOffs == statName.st_size) {
 		ABORT_FINALIZE(RS_RET_EOF);
 	} else {
 		/* we had a file change! */
+		DBGPRINTF("we had a file change on '%s'\n", pThis->pszCurrFName);
 		CHKiRet(strmCloseFile(pThis));
 		CHKiRet(strmOpenFile(pThis));
 	}