The log acquisition breaks upon log rotation

[pvbouwel]

Using this helm chart I can deploy agents + lapi successfully and it starts operating well.

In my setup I have agents processing traefik logs.
I used the following values:

agent:
  acquisition:
    - namespace: my-ns
      podName: traefik-*
      program: traefik

The setup comes up nicely and is working well for a while untill it gets "stuck" and no longer processes new activity. The last log lines are:

crowdsec-agent time="2026-03-11T18:45:07Z" level=info msg="Re-opening moved/deleted file /var/log/containers/traefik-gdxbd_my-ns_traefik-f77cf417756568018518abbf6cd0d4eb16a57eb2ccc4c44be55e91b5a34e343d.log ..."
crowdsec-agent time="2026-03-11T18:45:07Z" level=info msg="Waiting for /var/log/containers/traefik-gdxbd_my-ns_traefik-f77cf417756568018518abbf6cd0d4eb16a57eb2ccc4c44be55e91b5a34e343d.log to appear..."    

A deeper look also shows crowdsec actually warns about this behavior: time="2026-03-12T10:49:02Z" level=warning msg="File /var/log/containers/traefik-gdxbd_my-ns_traefik-f77cf417756568018518abbf6cd0d4eb16a57eb2ccc4c44be55e91b5a34e343d.log is a symlink, but inotify polling is enabled. Crowdsec will not be able to detect rotation. Consider setting poll_without_inotify to true in your configuration" file=/var/log/containers/traefik-gdxbd_my-ns_traefik-f77cf417756568018518abbf6cd0d4eb16a57eb2ccc4c44be55e91b5a34e343d.log module=acquisition.file type=file

Still creating an issue to avoid others from hitting this. Suggestions of how to improve experience:

• Add warning in values file for the example
• Have default of poll_without_inotify: true ( different from crowdsec default but makes sense as kubernetes environments will often have symlinks for the log-path that is used in this chart)

workaround

Adding poll_without_inotify: true does seem to resolve the issue.

[github-actions]

@pvbouwel: Thanks for opening an issue, it is currently awaiting triage.

If you haven't already, please provide the following information:

• kind : bug, enhancementor documentation
• area : agent, appsec, configuration, cscli, local-api

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.

[github-actions]

@pvbouwel: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.

• /kind bug
• /kind documentation
• /kind enhancement

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the forked project rr404/oss-governance-bot repository.

[pvbouwel]

/kind bug

[pvbouwel]

/area agent