All Apps and Add-ons

Splunk Add-on for Tomcat: Splunk forwarder not sending tomcat logs

aksharp
Explorer

We have configured Splunk forwarder system to send logs to Indexer. But for one particular application server Splunk forwarder stops sending logs for tomcat randomly, it forwards all other logs from the same directory. This continues until we restart Splunk forwarder manually. The issue is more frequent now happening once a week and we have no logs for that source in our Logmanager system till Splunk forwarder picks it up again.

The Info says something like below:

WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='XXXX'

This is happening mostly after the log file is rotated. We are using Splunk Universal Forwarder 7.0.0 (build c8a78efdd40f)

Any help would be appreciated.

0 Karma
1 Solution

skalliger
SplunkTrust
SplunkTrust

Try to increase initCrcLength to 512 for the input stanza and if that's not enough you can try adding crcSalt = <SOURCE> (literally).

Skalli

View solution in original post

0 Karma

skalliger
SplunkTrust
SplunkTrust

Try to increase initCrcLength to 512 for the input stanza and if that's not enough you can try adding crcSalt = <SOURCE> (literally).

Skalli

0 Karma
Get Updates on the Splunk Community!

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...