topic Re: Splunk Forwarder preventing application from logging in Getting Data In

Splunk Forwarder preventing application from logging

ebuljan — Mon, 11 Jun 2018 21:34:04 GMT

Our Splunk Forwarder on Windows Server is monitoring 2 folders containing approximately 1k log files total. I am ignoring the vast majority of the files. Each log file is fairly large, and is constantly being written to. Each one contains a day's worth of data, about 24k lines of text when the day is over.

When the Splunk Forwarder is on, the application that logs to it seems to skip logging intermittent lines of text. When it is off, all lines are logged.

Our inputs.conf file is very sparse:

[monitor://C:\Data\Import\log\*.log]
ignoreOlderThan = 2d 

[monitor://C:\Data\Export\log\*.log]
ignoreOlderThan = 2d

Any suggestions?

Re: Splunk Forwarder preventing application from logging

cpetterborg — Mon, 11 Jun 2018 21:56:29 GMT

Any pertinent information in the Windows Application logs?

Re: Splunk Forwarder preventing application from logging

MuS — Mon, 11 Jun 2018 23:06:00 GMT

It might be also worth to check for anti virus software doing things ....

Re: Splunk Forwarder preventing application from logging

esix_splunk — Tue, 12 Jun 2018 05:20:57 GMT

Does this log file get written to the top (head) of the file, or appended to the end of the file?

Take a look at CRCSALT or or FollowTail options for inputs.conf.

See here : https://docs.splunk.com/Documentation/Splunk/7.1.1/Data/Howlogfilerotationishandled

Re: Splunk Forwarder preventing application from logging

ebuljan — Thu, 14 Jun 2018 16:29:29 GMT

Nothing special in there

Re: Splunk Forwarder preventing application from logging

ebuljan — Thu, 14 Jun 2018 16:33:25 GMT

Thanks for your response. They are being written to the bottom.

A new file with a new name is created every day, so it doesn't sound like the CRC or FollowTail options would help in this case: "Do not use followTail for rolling log files (log files that get renamed as they age)..."

Re: Splunk Forwarder preventing application from logging

ebuljan — Thu, 14 Jun 2018 19:31:21 GMT

To clarify, Splunk is logging everything in the log files that it is monitoring, as expected.

But when the Splunk Forwarder is on, there are gaps in the log files.