Vector agent could not find file to watch after running sudo systemctl start vector

[Joshualy94]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Problem

Hi,

I got a problem that when I want to use 'file' source to monitor logs files, it worked with vector executable:

vector --config vector.toml 

with logs:

source{component_kind="source" component_id=log component_type=file component_name=log}:file_server: vector::internal_events::file::source: Found new file to watch. file=/home/ubuntu/logs/canary/1/2/3/4/5.log
2023-11-02T11:43:58.933251Z  INFO source{component_kind="source" component_id=log component_type=file component_name=log}:file_server: vector::internal_events::file::source: Found new file to watch. file=/home/ubuntu/logs/canary/1/2/3/4/test.log

Which looks good to me.

However, it won't be able to find the file to watch when I ran

sudo systemctl start vector

logs:

Nov 02 11:35:14 ip-10-4-1-129 systemd[1]: Started Vector.
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.618550Z  INFO vector::app: Log level is enabled. level="vector=info,codec=info,vrl=info,file_source=info,tower_limit=info,rdkafka=info,buffers=info,lapin=info,kube=info"
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.619429Z  WARN vector::config::loading: DEPRECATED Using the deprecated "/etc/vector/vector.toml" config path as the default config location. Vector is migrating to YAML as the default config format. Future>
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.619532Z  INFO vector::app: Loading configs. paths=["/etc/vector/vector.toml"]
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.775263Z  INFO vector::topology::running: Running healthchecks.
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.775387Z  INFO vector: Vector has started. debug="false" version="0.33.0" arch="x86_64" revision="89605fb 2023-09-27 14:18:24.180809939"
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.775403Z  INFO vector::app: API is disabled, enable by setting `api.enabled` to `true` and use commands like `vector top`.
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.775765Z  INFO source{component_kind="source" component_id=log component_type=file component_name=log}: vector::sources::file: Starting file server. include=["/home/*/logs/**/*.log"] exclude=[]
Nov 02 11:35:14 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:14.780520Z  INFO source{component_kind="source" component_id=log component_type=file component_name=log}:file_server: file_source::checkpointer: Loaded checkpoint data.
Nov 02 11:35:15 ip-10-4-1-129 vector[306863]: 2023-11-02T11:35:15.291235Z  INFO vector::topology::builder: Healthcheck passed.

where the above logs are missing, which confused me because both of them are running with the same config file.

Related config:

[sources.log]
type = "file"
include = ["/home/*/logs/**/*.log"]
ignore_checkpoints = true
read_from = "beginning"
fingerprinting.strategy = "device_and_inode"

Anyone could help?

Thanks!

Configuration

No response

Version

vector 0.33.0 (x86_64-unknown-linux-gnu 89605fb 2023-09-27 14:18:24.180809939)

Debug Output

source{component_kind="source" component_id=log component_type=file component_name=log}:file_server: vector::internal_events::file::source: Found new file to watch. file=/home/ubuntu/logs/canary/1/2/3/4/5.log
2023-11-02T11:43:58.933251Z  INFO source{component_kind="source" component_id=log component_type=file component_name=log}:file_server: vector::internal_events::file::source: Found new file to watch. file=/home/ubuntu/logs/canary/1/2/3/4/test.log

Example Data

No response

Additional Context

No response

References

No response

[StephenWakely]

I suspect this is a permissions thing. Does the vector user have access to the folders in question?