topic Why is my universal forwarder reporting "INFO WatchedFile - Resetting fd to re-extract header"? in Getting Data In

Why is my universal forwarder reporting "INFO WatchedFile - Resetting fd to re-extract header"?

a212830 — Tue, 29 Sep 2020 08:40:24 GMT

One of my servers running a universal forwarder is spitting out this message quite frequently:

02-04-2016 16:48:49.607 -0500 INFO  WatchedFile - Resetting fd to re-extract header.

What is this telling me? Each file does have a header, which we ignore via the FIELD_HEADER_REGEX parameter. Is it telling me that the header is being extracted? (These files roll over quite a bit).

Re: Why is my universal forwarder reporting "INFO WatchedFile - Resetting fd to re-extract header"?

sloshburch — Thu, 04 Feb 2016 23:21:19 GMT

I imagine its just letting you know the file is being opened from the start again. Might be resulting from the crcSalt but I honestly don't know - just guessing.

Also worth noting that its an INFO log entry so its not necessarily telling you of a problem. Is there a larger issue you are trying to address and believe this to be a symptom of?

Re: Why is my universal forwarder reporting "INFO WatchedFile - Resetting fd to re-extract header"?

reansh — Tue, 08 Feb 2022 15:16:38 GMT

Headers from a csv files are also getting ingested while props and transforms are defined to discard the headers as per following configs:
[sourcetype]
REGEX = Username
DEST_KEY = queue
FORMAT = nullQueue

Username is my header.