Why am I getting forwarder error "TailReader - File will not be read, seekptr checksum did not match" and how can I fix this?

kawashita_t — Tue, 29 Sep 2020 08:28:21 GMT

■ErrorMessages
01-20-2016 16:35:21.999 +0900 ERROR TailReader - File will not be read, seekptr checksum did not match (file=path\DhcpSrvLog-Wed.log). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

■inputs.conf
[monitor://path]
disabled = false
index = main
host = ***
sourcetype = DHCP
whitelist = DhcpSrvLog-Wed.log
crcSalt = TestDHCP

■props.conf
[DHCP]
CHARSET = SHIFT-JIS
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true

Re: Why am I getting forwarder error "TailReader - File will not be read, seekptr checksum did not match" and how can I fix this?

jplumsdaine22 — Wed, 20 Jan 2016 18:01:57 GMT

You have crcSalt = TestDHCP in your props.conf

I would remove the crcSalt setting entirely unless you are sure you need it (then restart splunk)

Alternatively, set it to

crcSalt = <SOURCE>

See the section labelled crcSalt at http://docs.splunk.com/Documentation/Splunk/6.3.2/Admin/Inputsconf

topic Why am I getting forwarder error "TailReader - File will not be read, seekptr checksum did not match" and how can I fix this? in Getting Data In

Why am I getting forwarder error "TailReader - File will not be read, seekptr checksum did not match" and how can I fix this?

Re: Why am I getting forwarder error "TailReader - File will not be read, seekptr checksum did not match" and how can I fix this?