All Apps and Add-ons

Splunk Add-on for Tomcat: Splunk forwarder not sending tomcat logs

aksharp
Explorer

We have configured Splunk forwarder system to send logs to Indexer. But for one particular application server Splunk forwarder stops sending logs for tomcat randomly, it forwards all other logs from the same directory. This continues until we restart Splunk forwarder manually. The issue is more frequent now happening once a week and we have no logs for that source in our Logmanager system till Splunk forwarder picks it up again.

The Info says something like below:

WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='XXXX'

This is happening mostly after the log file is rotated. We are using Splunk Universal Forwarder 7.0.0 (build c8a78efdd40f)

Any help would be appreciated.

0 Karma
1 Solution

skalliger
SplunkTrust
SplunkTrust

Try to increase initCrcLength to 512 for the input stanza and if that's not enough you can try adding crcSalt = <SOURCE> (literally).

Skalli

View solution in original post

0 Karma

skalliger
SplunkTrust
SplunkTrust

Try to increase initCrcLength to 512 for the input stanza and if that's not enough you can try adding crcSalt = <SOURCE> (literally).

Skalli

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!