topic WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file - Does this mean it exists? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/WatchedFile-File-too-small-to-check-seekcrc-probably-truncated/m-p/435307#M75953 <P>I am writing a splunk forwarder to our own splunk instance. For some reason, my logs are not shipping and its frustrating. The docker instance we have is fargate so I can not ssh into the instance and debug whether the logs exist.</P> <P>One of my splunkforwarder logs indicated</P> <PRE><CODE>WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file </CODE></PRE> <P>Does this mean it sees this file/this file existed? I want to make sure that my multicontainer are working as -</P> <P>A and B - where B is the splunkforwarder</P> <OL> <LI>A is wring to the location (/app/logs) - means this file must have been created by A</LI> <LI>B using VolumeFrom is about to mount the volume from A</LI> <LI>B has access to the logs within /app/logs/</LI> </OL> Wed, 19 Jun 2019 21:51:27 GMT exocore123 2019-06-19T21:51:27Z WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file - Does this mean it exists? https://community.splunk.com/t5/Getting-Data-In/WatchedFile-File-too-small-to-check-seekcrc-probably-truncated/m-p/435307#M75953 <P>I am writing a splunk forwarder to our own splunk instance. For some reason, my logs are not shipping and its frustrating. The docker instance we have is fargate so I can not ssh into the instance and debug whether the logs exist.</P> <P>One of my splunkforwarder logs indicated</P> <PRE><CODE>WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file </CODE></PRE> <P>Does this mean it sees this file/this file existed? I want to make sure that my multicontainer are working as -</P> <P>A and B - where B is the splunkforwarder</P> <OL> <LI>A is wring to the location (/app/logs) - means this file must have been created by A</LI> <LI>B using VolumeFrom is about to mount the volume from A</LI> <LI>B has access to the logs within /app/logs/</LI> </OL> Wed, 19 Jun 2019 21:51:27 GMT https://community.splunk.com/t5/Getting-Data-In/WatchedFile-File-too-small-to-check-seekcrc-probably-truncated/m-p/435307#M75953 exocore123 2019-06-19T21:51:27Z