All Apps and Add-ons

Splunk Add-on for Tomcat: Splunk forwarder not sending tomcat logs

aksharp
Explorer

We have configured Splunk forwarder system to send logs to Indexer. But for one particular application server Splunk forwarder stops sending logs for tomcat randomly, it forwards all other logs from the same directory. This continues until we restart Splunk forwarder manually. The issue is more frequent now happening once a week and we have no logs for that source in our Logmanager system till Splunk forwarder picks it up again.

The Info says something like below:

WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='XXXX'

This is happening mostly after the log file is rotated. We are using Splunk Universal Forwarder 7.0.0 (build c8a78efdd40f)

Any help would be appreciated.

0 Karma
1 Solution

skalliger
Motivator

Try to increase initCrcLength to 512 for the input stanza and if that's not enough you can try adding crcSalt = <SOURCE> (literally).

Skalli

View solution in original post

0 Karma

skalliger
Motivator

Try to increase initCrcLength to 512 for the input stanza and if that's not enough you can try adding crcSalt = <SOURCE> (literally).

Skalli

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...