WARN FileClassifierManager: The file is invalid. Reason: cannot_open

leticiamartello — Mon, 04 Nov 2019 17:33:56 GMT

I have a watched file on a Universal Forwarder (Windows) and the file is send to the Heavy Forwarder (linux), but some file are not indexed, and some are indexed. This is the configuration on inputs.conf (Heavy Forwarder):

[monitor://D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxxx_xxxxxx_*.CSV]
index=index_xxx
source=ccc:ccc
sourcetype=ccc:ccc
disabled = 0
time_before_close = 60
multiline_event_extra_waittime = true
initCrcLength = 512

I'm getting these errors:

11/1/19 7:33:12.398 PM11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O0055xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx  index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/197:33:12.398 PM 11-01-2019 19:33:12.398 -0300 ERROR TailReader - error from read call from 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'. host = SRVCNFS02index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM  11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - The file 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV' is invalid. Reason: cannot_open
host = xxxx index = _internalsource = C:\Program Files\SplunkUniversalForwarder\var\log\splunk\splunkd.logsourcetype = splunkd

11/1/19 7:33:12.398 PM 11-01-2019 19:33:12.398 -0300 WARN  FileClassifierManager - Unable to open 'D:\Dados\xxx\Compartilhado\TECNOL~1\MONITO~1\TransUnion2Splunk\O00555xxxx_xxxx_20191101190001.CSV'.

Does anyone know what is wrong?

Thnak you!

Re: WARN FileClassifierManager: The file is invalid. Reason: cannot_open

codebuilder — Fri, 15 Nov 2019 05:37:27 GMT

Splunk cannot read the file because it does not have the required permissions.
Though I'm not a Windows guru (far from it), this is similar to Splunk running as the "splunk" user, and trying to monitor files owned by root.
Change the ownership or privileges on the directory, or change the account that Splunk itself runs as.

Re: WARN FileClassifierManager: The file is invalid. Reason: cannot_open

corey_dick — Wed, 22 Jul 2020 18:16:35 GMT

I'm having the same issue. I double checked and the account that Splunk is running under has Full Control of both the file and the folder.

topic WARN FileClassifierManager: The file is invalid. Reason: cannot_open in Getting Data In

WARN FileClassifierManager: The file is invalid. Reason: cannot_open

Re: WARN FileClassifierManager: The file is invalid. Reason: cannot_open

Re: WARN FileClassifierManager: The file is invalid. Reason: cannot_open