topic Re: Checksum for logs ? How to disable ? in Monitoring Splunk

Checksum for logs ? How to disable ?

konradwawryn — Mon, 14 Jan 2013 14:23:55 GMT

Hi,

I cant forward Tomcat logs because of this strange error. This is development server so content of tomcat/logs is changing very often - sometimes we need to remove all logs to create new ones. How to disable checksum feature for development logs ?

01-14-2013 15:13:33.882 +0100 ERROR TailingProcessor - File will not be read, seekptr checksum did not match (file=/home/application/tomcat/logs/catalina.out).  Last time we saw this initcrc, filename was different.  You may wish to use a CRC salt on this source.  Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info.

Re: Checksum for logs ? How to disable ?

Drainy — Mon, 14 Jan 2013 14:42:31 GMT

You don't need to disable it, as it suggests you just need to add a Crcsalt so it doesn't match the other file it appears to have read in.

Usually this suggests that the header of the file is identical to other files you're indexing or you have indexed duplicates so take care, but you can add this to your [monitor] stanza in inputs.conf for the related file;

crcSalt = <SOURCE>

With the <SOURCE> keyword included exactly as its typed above. This will force Splunk to use the source path in the cRc check and avoid matching similar logs from other files. If you use a different filename for dev work then you shouldn't hit any problems. Otherwise you may just want to avoid clearing the log, once its indexed in Splunk you could just note the timestamp of the dev change and ignore all data indexed before that.

Re: Checksum for logs ? How to disable ?

konradwawryn — Mon, 14 Jan 2013 15:02:31 GMT

Thanks for Your help 🙂 Its working.

Re: Checksum for logs ? How to disable ?

Drainy — Mon, 14 Jan 2013 15:16:06 GMT

Np, glad it helped! 🙂