topic Splunk error message on splunkd.log in Getting Data In

Splunk error message on splunkd.log

OMohi — Tue, 29 Sep 2020 06:40:08 GMT

I am getting the following error message from inputs directing from splunk forwarder instance to indexer:

13:01:22.582 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/xfer/XXXlogs/retail_sales_dm_ci_comm.rows'.
07-13-2015 13:01:22.636 -0400 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/xfer/XXX/logs/retail_sales_dm_ci_comm_sql.out.Mon'.
07-13-2015 13:01:25.613 -0400 INFO WatchedFile - Checksum for seekptr didn't match, will re-read entire file='/xfer/XXX/logs/IFM_FACT_wf_edw_mbr_alloc_sum_skey_coid_xref.out'

This is my inputs.conf configuration:

[monitor:///xfer/XXX/logs/*]
index = <index_name>
sourcetype = <sourcetype>
crcSalt = <SOURCE>

I am unable to see latest events as a result.

Please provide feedback on how to overcome this issue.

Thanks,

Mohammed Mohiuddin

Re: Splunk error message on splunkd.log

martin_mueller — Mon, 13 Jul 2015 21:35:06 GMT

These are no error messages, they're informational messages telling you that Splunk is re-reading files after they've been replaced with different content.

Re: Splunk error message on splunkd.log

prakash007 — Fri, 06 May 2016 19:35:04 GMT

martin,
I do see lot of these messages in splunkd.logs, is splunk re-indexing the data or can i ignore these messages...?

     File too small to check seekcrc, probably truncated.  Will re-read entire file=...filepath
     File too small to check seekcrc, probably truncated.  Will re-read entire file=...filepath
    INFO  WatchedFile - Logfile truncated while open, original pathname file=...filepath. , will begin reading from start.
    INFO  WatchedFile - Logfile truncated while open, original pathname file=...filepath., will begin reading from start.


input.conf on UFs................

 [monitor:///opt/app/ws/server/*/log/server.log]
 sourcetype=log4j
 crcSalt = <source>
 index=testenv

Re: Splunk error message on splunkd.log

martin_mueller — Sun, 08 May 2016 17:38:17 GMT

It says a watched file was truncated and that Splunk will begin reading that file from the new start.

Most likely reason: Log rotation.

Re: Splunk error message on splunkd.log

prakash007 — Mon, 09 May 2016 02:09:25 GMT

These two are different messages on different UFs..

File too small to check seekcrc, probably truncated.  Will re-read entire file=...filepath

INFO  WatchedFile - Logfile truncated while open, original pathname file=...filepath. , will begin reading from start.

For the monitor path in the stanza, the log rotates and gets saved as server.log.05082016 every day @midnight. I don't think splunk reads that rolled over file as we didn't mention the path in the monitor stanza, isn't it so...?

[monitor:///opt/app/ws/server/*/log/server.log]

Re: Splunk error message on splunkd.log

martin_mueller — Tue, 10 May 2016 20:30:59 GMT

If you tell Splunk to read server.log, Splunk's not going to read server.log.05082016.

You should tell Splunk to read that though, in case an event was written and rotated out before Splunk caught it.

Re: Splunk error message on splunkd.log

prakash007 — Thu, 12 May 2016 18:34:15 GMT

If i tell splunk to read both server.log in monitor stanza([monitor:///opt/app/ws/server/*/log/server.log])
and also archived/backed up server.log.05082016..does this lead to double indexing of the events..?