file sink use logrotate copytruncate does not truncate successfully

[QSummerY]

Use helm to deploy vector-aggregator in k8s, and its configuration is as follows:

data_dir: /logfs/vector
acknowledgements:
  enabled: true

api:
  address: 0.0.0.0:8686
  enabled: true
  playground: false

sources:
  kafka_source:
    type: "kafka"
    topics:
      - "test1"
    group_id: test1
    bootstrap_servers: xxx
    librdkafka_options:
      "security.protocol": xxx
      "sasl.mechanism": xxx
      "sasl.username": "xxx"
      "sasl.password": "xxx"

  internal_metrics:
    type: internal_metrics
    scrape_interval_secs: 2
    tags:
      host_key: ""

transforms:
  kafka_message_unpack:
    inputs:
      - "kafka_source"
    type: "remap"
    source: |
      . = parse_json!(.message)
      parsed_log, err = parse_json(.msg)
      if err == null {
        . = merge!(., parsed_log)
      }

  reduce_message:
    inputs:
      - "kafka_message_unpack"
    type: reduce
    max_events: 50
    merge_strategies:
      message: concat_newline

sinks:
  test_log_file:
    type: file
    inputs:
      - "reduce_message"
    path: /logfs/vector/{{ print "{{ category }}" }}/${POD_NAME}/{{ print "{{ category }}" }}-%F.log
    encoding:
      codec: raw_message

  prom-exporter:
    type: prometheus_exporter
    inputs:
      - internal_metrics
    address: 0.0.0.0:9598

I want to limit the file size. I searched and found that vector has no relevant function and suggested using logrotate to implement it. Therefore, logrotate is used to rotate according to the file size, and the configuration is as follows:

# test the specified file
/fuse/logfs/vector/ban.ban_read_flink_log/vector-aggregator-0/ban.ban_read_flink_log-2025-04-17.log {
        daily
        dateext
        dateformat -%Y%m%d%H%M%S
        copytruncate
        maxsize 500M
        rotate -1
        missingok
        notifempty
}

After testing, it was found that Logrotate Successful, original file goes back to original size

Verbose Output of Logrotate
copying /fuse/logfs/vector/ban.ban_read_flink_log/vector-aggregator-0/ban.ban_read_flink_log-2025-04-17.log to /fuse/logfs/vector/ban.ban_read_flink_log/vector-aggregator-0/ban.ban_read_flink_log-2025-04-17.log-20250417102809
truncating /fuse/logfs/vector/ban.ban_read_flink_log/vector-aggregator-0/ban.ban_read_flink_log-2025-04-17.log

Log file after truncate happens
-rw-r--r-- 1 root root    0 Apr 17 10:28 ban.ban_read_flink_log-2025-04-17.log
-rw-r--r-- 1 root root 632M Apr 17 10:28 ban.ban_read_flink_log-2025-04-17.log-20250417102809

Literally Seconds Later
-rw-r--r-- 1 root root 634M Apr 17 10:28 ban.ban_read_flink_log-2025-04-17.log
-rw-r--r-- 1 root root 632M Apr 17 10:28 ban.ban_read_flink_log-2025-04-17.log-20250417102809

od -c ban.ban_read_flink_log-2025-04-17.log | head -n 10
0000000  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
*
4736315260  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0   S   U   C
4736315300   C   E   S   S   (   S   c   a   n   B   y   I   P   U   A   N
4736315320   U   R   L       D   o   S   (   2   2   2   /   6   0   0   .
4736315340   0   )   )   ,       p   a   y   l   o   a   d   :       {   "
4736315360   r   u   l   e   _   t   y   p   e   "   :       "   s   c   a
4736315400   n   _   c   o   u   n   t   "   ,       "   i   p   "   :
4736315420   "   1   1   0   .   1   6   6   .   2   1   3   .   1   4   4
4736315440   "   ,       "   u   s   e   r   _   a   g   e   n   t   "   :

But strangely, when starting local vector -c vector.yaml, a file of about 1G size is created through dd, and then logs are generated through demo_logs and continuously written to the file. After using the same logrotate, no abnormality is reproduced

It is suspected that the written oftest has not been reset.ref The file system uses juicefs, which is mounted in the vector running in K8S through juicefs-csi-driver. Logrotate runs in a machine that also mounts the same file system. Is it related to this configuration? How should I make it work properly, or can the file sink provide a corresponding file size limit processing method ?

I will continue to try to see if there is any easy way to reproduce it.