I have these info messages popping up in my splunk install every couple of seconds
09-25-2012 09:37:40.378 -0500 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/logging/syslog-ng/everything'.
09-25-2012 09:37:40.378 -0500 INFO WatchedFile - Will begin reading at offset=0 for file='/logging/syslog-ng/everything'.
But the file that it is monitoring is growing nicely. Sooooo why?
Is it really re-reading the file every couple of seconds? It's a huge file; 14 gig+
Running splunk 4.3.4.
Hi,
Same issue here.
Same error message, on a file that is 4Go+.
Any idea ?
Running splunk 4.3.2