In current defaults, skip_long_lines is set to OFF.

This means that if a log file has a log line which exceeds the buffer_max_size, Fluent Bit will stop monitoring that file entirely.

This suggests that if someone could maliciously write a long log line to a file (e.g. /var/log/security or /var/log/messages , they could then take actions which are logged into that file without fear that Fluent Bit would properly route those messages to a place in which they were being monitored.

Better behavior would be to truncate long log lines, rather than simply skip them. (indeed, this is the default behavior I might naively expect)