Add Werk 19272 FIX Text logfiles: New messages dropped silently when reaching limit for stored messages

SUP-26490

Change-Id: Ia41e37601cb98157b6863e984c5f780c8af683f4

Author: andiumbreit

.werks/19272.md

@@ -0,0 +1,24 @@
+[//]: # (werk v3)
+# Text logfiles: New messages dropped silently when reaching limit for stored messages
+
+key        | value
+---------- | ---
+date       | 2026-01-28T16:03:22+00:00
+version    | 2.4.0p21
+class      | fix
+edition    | cre
+component  | checks
+level      | 1
+compatible | yes
+
+The _Text logfiles_ check (_mk\_logwatch_), when reaching the maximum file size for saved messages, dropped new log messages silently without any notification.  
+This led to a nonfunctional logfile monitoring that didn't process any new messages, and especially failed to detect WARN or CRIT patterns.
+
+This is how it should have worked:  
+During the processing of log messages with _mk\_logwatch_, relevant messages (depending on the logwatch configuration) are saved to a file on the monitoring server, and can be observed/acknowledged with the menu entry _Open log_ under the service's action menu.  
+When this log file reaches the limit of 500 KB, _mk\_logwatch_ stops processing further messages, and the service shows the message `Unacknowledged messages have exceeded max size, new messages are dropped`, requiring the user to take action.
+
+With this Werk, the maximum file size detection is functional again.  
+
+Please note that to resume monitoring you still must acknowledge the saved log messages.  
+This is done by navigating to the log file via the _Open log_ entry and hitting _Clear log_.

cmk/plugins/logwatch/agent_based/logwatch.py

@@ -604,6 +604,10 @@ def _extract_blocks(
     *,
     limit: float = float("inf"),
 ) -> Iterable[LogwatchBlock]:
+    """Extract logwatch blocks from the given lines.
+    When limit is reached, stop processing further lines, but yield the current block so it can be
+    written to file, triggering the file size limit.
+    """
     current_block = None
     for line in lines:
         line = line.rstrip("\n")
@@ -618,6 +622,7 @@ def _extract_blocks(
             current_block.add_line(line, reclassify)
             limit -= len(line.encode("utf-8"))
             if limit <= 0:
+                yield current_block
                 return
 
     if current_block is not None: