Splunk Add-on for Tomcat: Splunk forwarder not sending tomcat logs

[aksharp]

We have configured Splunk forwarder system to send logs to Indexer. But for one particular application server Splunk forwarder stops sending logs for tomcat randomly, it forwards all other logs from the same directory. This continues until we restart Splunk forwarder manually. The issue is more frequent now happening once a week and we have no logs for that source in our Logmanager system till Splunk forwarder picks it up again.

The Info says something like below:

WatchedFile - File too small to check seekcrc, probably truncated.  Will re-read entire file='XXXX'

This is happening mostly after the log file is rotated. We are using Splunk Universal Forwarder 7.0.0 (build c8a78efdd40f)

Any help would be appreciated.

[skalliger · Accepted solution]

Try to increase initCrcLength to 512 for the input stanza and if that's not enough you can try adding crcSalt = <SOURCE> (literally).

Skalli