topic Permissions on monitored files in Security

Permissions on monitored files

RicoSuave — Thu, 29 Nov 2012 17:16:59 GMT

If permissions get changed on a log file that is being monitored by splunk and becomes unreadable, will Splunk give up permanently on rechecking the readability of the log without an agent restart? Just wondering what the testing logic is and whether the agent will resume collecting the logs once the log file permissions are returned to readable?

Re: Permissions on monitored files

yannK — Thu, 29 Nov 2012 17:29:57 GMT

The behavior changed in 4.3.3, before the Tailing processor was trying 10 times to read a file then gave up (if permission were restrictives or the file locked). So the only way was to restart the forwarder to redetect the file (or use the REST endpoint to reload the tailing processor)

Since late 4.3.3 and 5.0.*, the Tailing processor retry after in interval of time, this interval increase with each failure to maximum of 34 minutes.

see http://docs.splunk.com/Documentation/Splunk/4.3.4/ReleaseNotes/4.3.3

When tailing files, consecutive failures for accessing or handling the same pathname will result in a doubling interval up to 0.5s * 2^(12), or 1 * 2^(11) seconds or 2048 seconds, or 34 minutes and 8 seconds. If more errors are encountered, the timer will remain at 34 minutes and 8 seconds. (SPL-50995)

Re: Permissions on monitored files

RicoSuave — Thu, 29 Nov 2012 17:35:27 GMT

Thank you, le sir!

Re: Permissions on monitored files

piebob — Thu, 29 Nov 2012 18:07:37 GMT

LIKE A SIR