Fatal Error: "canceled after reaching timeout for external stream" during File Stream Processing (LogShark v4.2.4.0)

[Ashwyn2601]

Note - I am able to run logshark(4.2.4) against another Tableau server ziplog which is on the same version successfully.

However, when running against this environment which is on the same version (2024.3.12), I keep running into this issue:

1. Run Failure Details:

   • Total Run Time: 01:47:58
   • Error Message:
     Unhandled exception occurred while processing file stream from file "node1/vizqlserver_0.20242.25.0710.15397096112173115596405/logs/nativeapi_vizqlserver_1-0_2025_11_28_00_00_00.txt". Processing aborted.
   • The issue appears to be related to a HyperAPI.HyperException:
     canceled after reaching timeout for external stream.
   • Exception Context: node1/vizqlserver_0.20242.25.0710.15397096112173115596405/logs/nativeapi_vizqlserver_1-0_2025_11_28_00_00_00.txt
   • Error occurred inside ResourceManagerEventsProcessor while attempting to handle a MemorySampleEvent from the Vizqlserver log.

2. General Observation:

   • Processing failed due to the specific vizqlserver log file (nativeapi_vizqlserver_1-0_2025_11_28_00_00_00.txt) timing out while being processed by the LogShark pipeline.
   • As per my analysis this issue could be likely linked to a large or malformed log file, resulting in the reading process being terminated. I will need community's help on this.

3. Log Set Stats:

   • Input: 71,540 MB compressed.
   • Output Stats:
     • Total Errors Logged: 1,913 errors.
     • All errors reported by the BackgrounderPlugin but appear unrelated to the fatal processing failure.
     • VizqlserverCpp: Processed the largest total log size (316,912 MB in 63 files at 981.22 MB/sec).
   • General Performance: Most other plugins processed relatively smaller datasets at higher speeds.

4. Final Note:

   • After the timeout exception, LogShark terminated the entire process, cleaned temporary files, and rolled back the processing task.

---

• The root cause seems to be a large or malformed Vizqlserver log file that leads to a timeout during processing by the HyperAPI component of LogShark. Has anyone experienced similar issues? Can someone suggest if any additional changes need to be made on the config files for processing files?