topic ERROR TailingProcessor - matching ... in Splunk Search

ERROR TailingProcessor - matching ...

annebeate — Fri, 11 May 2012 10:21:09 GMT

Hi,

After upgrading splunk forwarder from version 4.2.1 to 4.3.1, the Splunk indexer does not receive any data. The indexer has the 4.3.1 version installed. I think the issue is related to symlinks. The monitored files have a symlink included: "current_release". I've tested that I'm able to forward data not including symlinks.

Error message:

05-11-2012 11:32:48.836 +0200 ERROR TailingProcessor - matching /progs/cosmos/cos/releases/domain_Cos69/release_69.0.0_dummy/ against ^/progs/cosmos/cos/releases/domain_Cos[^/]*/current_release/servers/CM[^/]*/config/Cos[^/]*/CM[^/]*/logs/[^/]*\.log$

Extract from inputs.conf:

[monitor:///progs/cosmos/cos/releases/domain_Cos*/current_release/CM*/startCM.sh_out]
disabled = false
sourcetype = cos_weblogic_stdout
index = s00386_cos_test_sys
crcSalt=/progs/cosmos/cos/releases/domain_Cos38/current_release/CM1/startCM.sh_out
crcSalt=/progs/cosmos/cos/releases/domain_Cos39/current_release/CM1/startCM.sh_out

[monitor:///progs/cosmos/cos/releases/domain_Cos*/current_release/CM*/logs/jmsSender.log*]
disabled = false
_blacklist = .*\.gz$
index = s00386_cos_test_app
sourcetype=cos_log4j

Re: ERROR TailingProcessor - matching ...

yannK — Wed, 06 Jun 2012 00:41:51 GMT

Hi Annebeate

This error message is a known issue, SPL-47988 " ERROR TailingProcessor - matching X against Y "
The message has in incorrect log level, and is not a legitimate error message and can be disregarded. It will be fixed in the version 4.3.4

Are you experiencing missing events from the monitored log files ?

Regards,
Splunk Support

Re: ERROR TailingProcessor - matching ...

annebeate — Wed, 06 Jun 2012 11:54:33 GMT

Hi,

Yes, the forwarder hasn't been sending any data since the 7th of May after reinstall of Splunk forwarder.

Regards,
Anne Beate

Re: ERROR TailingProcessor - matching ...

yannK — Wed, 06 Jun 2012 17:45:30 GMT

If you are as splunk enterprise customer, I recommend to fill a support case.

Otherwise, check any permissions issues no the forwarder side, change your monitor stanza.
and use the secret REST API on the forwarder to check the forwarder tailing processor. (as splunk admin, change the password before if needed)

https://localhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus