Archive
Highlighted

BTreeCP and snapshot.tmp in the fishbucket: What does it all mean?

SplunkTrust
SplunkTrust

I have a continuous repeat of the follow error in my splunkd.log:

ERROR BTreeCP - failed: failed to copy/move C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db\btree_index.dat to C:\Program Files\Splunk\var\lib\splunk\fishbucket\splunk_private_db\snapshot.tmp: The system cannot find the path specified.

What is the btree_index.dat and what are the implications of its failure to be copied as snapshot.tmp?

Highlighted

Re: BTreeCP and snapshot.tmp in the fishbucket: What does it all mean?

Splunk Employee
Splunk Employee

To an answer an ancient question (found it searching) this is a failure to create a backup.

The BTree is where Splunk records the file pointers, or bookmarks, of how far into various files with various content signatures we read, so that we only get new data from files.

Periodically we back this two-file database up into the snaphot subdirectory, and this is a part of that process.

If we goofed once along these lines, it is not a lot to worry about. Probably there was some concurrency error, but it just means once we missed one chance to make a backup. If this is happening all the time, it means you are more exposed to scenarios where the file might become damaged.

In practice, we haven't had these scenarios occur to my knowledge, this is just defensive programming. Still, if this happens all the time, we should look into it.

View solution in original post

Highlighted

Re: BTreeCP and snapshot.tmp in the fishbucket: What does it all mean?

SplunkTrust
SplunkTrust

ancient answer to ancient question now accepted! thanks!

Highlighted

Re: BTreeCP and snapshot.tmp in the fishbucket: What does it all mean?

Splunk Employee
Splunk Employee

I should wait until 2014, but can't help myself. You're welcome!