topic Re: FSChangeMonitor errors? in Security

FSChangeMonitor errors?

jgauthier — Tue, 19 Nov 2013 20:47:17 GMT

Does anyone have any idea why this is happening?

11-19-2013 15:17:34.908 -0500 ERROR SQLitePersistentStorageImpl - Error executing: select primarykey, value from keyvaluepairs_t where secondary1 = ?1 Msg=unable to open database file
11-19-2013 15:17:34.908 -0500 ERROR FSChangeMonitor - Exception thrown in update(2) - continuing

I have hundreds of these in my splunkd.log file.

Re: FSChangeMonitor errors?

jgauthier — Wed, 20 Nov 2013 15:26:59 GMT

I made changes to the permissions on the splunk folder for the splunk service (windows) and this error has resolved itself. Interesting since I just noticed it, and I've had a Splunk install for 2 years. I wonder if the upgrade to 6 changed something.

Re: FSChangeMonitor errors?

kfleming — Fri, 04 Dec 2015 17:41:47 GMT

To what did you change the permissions
what were they set to when it was failing

I have the same problem, but having difficulty find the folder causing the problem

Re: FSChangeMonitor errors?

andriy_noble — Wed, 02 Mar 2016 16:16:50 GMT

Also having the same issue, could you provide any steps for troubleshooting? As well as the fix?

Re: FSChangeMonitor errors?

rmorlen_splunk — Tue, 29 Sep 2020 09:25:37 GMT

You can try this if you are still having issues:

Browse to /opt/splunk/var/lib/splunk/persistentstorage/fschangemanager_state/ and in that directory, there is also a file called "fschangemanager_state". Rename that file or move it to a temporary location and then restart Splunk.