Input framework subsequent REREAD fails after file update

Description

I have a file that gets updated every hour and I am using it as a feed into bro using input framework. Every hour I write a list of IP addresses into this file. For many updates everything works fine but Occasionally, I see the following error:

Apr 6 05:00:09 Reporter::ERROR /feeds/Blacklist/CURRENT.24hrs_BRO/Input::READER_ASCII: could not read first line (empty)

After this failure/message, any subsequent updates on the file are ignored by the input framework.

From visual inspection the file looks just fine and header/data (1 column of IP addresses) is there as expected but somehow input framework doesn't like it. It seems that every hour when update the file using a cron script, on a rare occasion the file is empty for a minuscule duration after which this error starts.

for further REREADS data won't get updated into the tables anymore once the above Reporter::ERROR kicks in.

Please let me know if you need ways to reproduce this error condition or have more questions for me.

Environment

None

Assignee

Seth Hall

Reporter

Aashish Sharma

Labels

External issue ID

None

Components

Fix versions

Affects versions

Priority

Normal
Configure