topic Re: Universal Forwarder Crash _initCrcLen' failed. in Getting Data In

Universal Forwarder Crash _initCrcLen' failed.

Kieffer87 — Tue, 14 Feb 2017 18:53:57 GMT

I have a universal forwarder running that picks up bluecoat logs from a directory. Everything works as expected, however every couple of hours the forwarder randomly crashes with the following error message in splunkd_stderr.log:

splunkd: /home/build/build-src/ivory/src/pipeline/input/ArchiveProcessor.cpp:1062: bool ArchiveCrcChecker::write(const char*, size_t): Assertion `_dataProv.curPos() < _initCrcLen' failed.

The files are compressed and contain headers which may be part of my issue but I'd like to know a bit more what this error message is referring to. The forwarder crashed almost constantly before I added the initCrcLength = 1000. I plan to try and increase this number to see if it helps but my headers only tend to be 400-500 bytes.

Inputs.conf
    [batch:///logs/proxy/splunkwatch/SG_*.log.gz]
    source = file.bluecoat
    sourcetype = bluecoat:proxysg:access:file
    disabled = false
    index = proxy
    move_policy = sinkhole
    initCrcLength = 1000

The files are unique with a date/time stamp so I thought about using crcSalt = however splunk doesn't seem to read the files at all using that.

Thoughts on what may be going on?

Re: Universal Forwarder Crash _initCrcLen' failed.

ddrillic — Tue, 14 Feb 2017 20:32:49 GMT

Which version of the forwarder are you using? We had crashes saying StatWrap::isDir() const: Assertion_valid' failed` and by upgrading from 6.3.1 to 6.5, the problem got cleared.

Re: Universal Forwarder Crash _initCrcLen' failed.

Kieffer87 — Tue, 14 Feb 2017 20:33:51 GMT

Running a fresh install of 6.5.2

Re: Universal Forwarder Crash _initCrcLen' failed.

dwaddle — Wed, 15 Feb 2017 04:12:42 GMT

As a general rule, if you get an assertion that's a sign you need to submit a support case. To truly look into an assertion requires access to the source code, and few if any of us in the community have such rights.