topic How can we monitor binary log data in splunk? is invalid. Reason: binary in Getting Data In

How can we monitor binary log data in splunk? is invalid. Reason: binary

alexethier — Sun, 18 Dec 2011 04:04:05 GMT

I have a python script that read data from the stdin, convert the input and output human readable text to the stdout.
this is my current setup:

inputs.conf

[monitor:///var/account/pacct]
sourcetype = pacct_binary

props.conf

[pacct_binary]
invalid_cause = archive
unarchive_cmd = /opt/splunk/etc/apps/search/bin/pacct.py

I experimented with multiple configurations in inputs.conf and props.conf. No matter what I do I always get the following warning when splunk start and I don't see my sourcetype in splunk web gui.

WARN  FileClassifierManager - The file '/var/account/pacct' is invalid. Reason: binary
INFO  TailingProcessor - Ignoring file '/var/account/pacct' due to: binary

Anyone can post an exemple of a inputs.conf and props.conf that would let me load this binary file.

Best,

Alex

Re: How can we monitor binary log data in splunk? is invalid. Reason: binary

Ayn — Sun, 18 Dec 2011 22:52:59 GMT

Is there a reason for using monitor for this? The best option imho would be to run your pacct.py script directly as a script input and have Splunk simply read its stdout.

Re: How can we monitor binary log data in splunk? is invalid. Reason: binary

alexethier — Wed, 21 Dec 2011 20:57:51 GMT

No real reason. I'm new to Splunk. Thank you for the script input suggestion.

Re: How can we monitor binary log data in splunk? is invalid. Reason: binary

carmackd — Fri, 20 Apr 2012 19:41:48 GMT

You can simply ignore the binary check as well using the following props attribute.

#******************************************************************************
# Binary file configuration
#******************************************************************************

NO_BINARY_CHECK = [true|false]
* When set to true, Splunk processes binary files.
* Can only be used on the basis of [<sourcetype>], or [source::<source>], not [host::<host>].
* Defaults to false (binary files are ignored).